In the Linux kernel, the following vulnerability has been resolved:

can: bcm: extend bcm_tx_lock usage for data and timer updates

Stage new CAN frame content for an existing tx op into a kmalloc()'d
buffer and validate it there, mirroring the approach already used in
bcm_rx_setup(). Only copy the validated data into op->frames while
holding op->bcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler()
can no longer observe a partially updated or unvalidated frame.

Add a missing error path for memcpy_from_msg() when copying CAN frame
data from userspace.

Also move the kt_ival1/kt_ival2/ival1/ival2 updates in bcm_tx_setup()
under op->bcm_tx_lock, and read kt_ival1/kt_ival2/count under the same
lock in bcm_tx_set_expiry() and bcm_tx_timeout_handler(), closing the
torn 64-bit ktime_t read on 32-bit platforms.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
76c84c3728178b2d38d5604e399dfe8b0752645e affected < 52f06e7603780de100233713ddaf971d422e10ef
cc55dd28c20a6611e30596019b3b2f636819a4c0 affected < 972fd66bb08fdef1090abe43196ca8da07216d13
c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 affected < bd46f55dec608daa44b45dcf3328517630ad8e40
c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 affected < 337f966c00662d81ad82cf5a4bbb150b2e32c0d4
c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 affected < 12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc
8f1c022541bf5a923c8d6fa483112c15250f30a4 affected —
7595de7bc56e0e52b74e56c90f7e247bf626d628 affected —
fbd8fdc2b218e979cfe422b139b8f74c12419d1f affected —
2a437b86ac5a9893c902f30ef66815bf13587bf6 affected —
c4e8a172501e677ebd8ea9d9161d97dc4df56fbd affected —
6.6.93 affected < 6.6.148
6.12.31 affected < 6.12.101
5.4.294 affected < 5.5
5.10.238 affected < 5.11
5.15.185 affected < 5.16
6.1.141 affected < 6.2
6.14.9 affected < 6.15
Linux Linux affected
Version Status Constraints
6.15 affected —
0 unaffected < 6.15
6.6.148 unaffected ≤ 6.6.*
6.12.101 unaffected ≤ 6.12.*
6.18.42 unaffected ≤ 6.18.*
7.1.5 unaffected ≤ 7.1.*
7.2-rc4 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc cve-icon cve-icon
https://git.kernel.org/stable/c/337f966c00662d81ad82cf5a4bbb150b2e32c0d4 cve-icon cve-icon
https://git.kernel.org/stable/c/52f06e7603780de100233713ddaf971d422e10ef cve-icon cve-icon
https://git.kernel.org/stable/c/972fd66bb08fdef1090abe43196ca8da07216d13 cve-icon cve-icon
https://git.kernel.org/stable/c/bd46f55dec608daa44b45dcf3328517630ad8e40 cve-icon cve-icon
History

Sat, 15 Aug 2026 09:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1035
CWE-362

Sat, 15 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcm_tx_lock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc()'d buffer and validate it there, mirroring the approach already used in bcm_rx_setup(). Only copy the validated data into op->frames while holding op->bcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler() can no longer observe a partially updated or unvalidated frame. Add a missing error path for memcpy_from_msg() when copying CAN frame data from userspace. Also move the kt_ival1/kt_ival2/ival1/ival2 updates in bcm_tx_setup() under op->bcm_tx_lock, and read kt_ival1/kt_ival2/count under the same lock in bcm_tx_set_expiry() and bcm_tx_timeout_handler(), closing the torn 64-bit ktime_t read on 32-bit platforms.
Title can: bcm: extend bcm_tx_lock usage for data and timer updates
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T05:52:58.479Z

Reserved: 2026-08-09T03:40:39.906Z

Link: CVE-2026-72119

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:21:26.363

Modified: 2026-08-15T06:21:26.363

Link: CVE-2026-72119

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-15T09:00:06Z

Weaknesses