can: bcm: add locking when updating filter and timer values

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-72121
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-15 06:21:26 UTC
Updated2026-08-19 17:20:59 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and timer values KCSAN detected a simultaneous access to timer values that can be overwritten in bcm_rx_setup() when updating timer and filter content while bcm_rx_handler(), bcm_rx_timeout_handler() or bcm_rx_thr_handler() run concurrently on incoming CAN traffic. Protect the timer (ival1/ival2/kt_ival1/kt_ival2/kt_lastmsg) and filter (nframes/flags/frames/last_frames) updates in bcm_rx_setup() with a new per-op bcm_rx_update_lock, taken with the matching scope in the RX handlers. memcpy_from_msg() is staged into a temporary buffer before the lock is taken, since it can sleep and must not run under a spinlock. hrtimer_cancel() is always called without bcm_rx_update_lock held, since bcm_rx_timeout_handler()/bcm_rx_thr_handler() take the same lock and a running callback would otherwise deadlock against the canceller. Also close a related race: bcm_rx_setup() cleared the RTR flag in the stored reply frame's can_id as a separate, unprotected step after the frame content was already installed, so a concurrent bcm_rx_handler() could transmit a stale reply with CAN_RTR_FLAG still set. Fold that normalization into the initial frame preparation instead (on the staged buffer for updates, directly on op->frames pre-registration for new ops), so the installed frame is always atomically self-consistent. bcm_rx_handler()'s RX_RTR_FRAME check now takes a lock-protected snapshot of op->flags before deciding whether to call bcm_can_tx(), but does not hold the lock across that call. Also take a lock-protected snapshot of the currframe in bcm_can_tx() to avoid partly overwrites by content updates in bcm_tx_setup(). Finally check if a TX_RESET_MULTI_IDX/SETTIMER might have reset op->currframe between the two locked sections in bcm_can_tx(). Omit calling hrtimer_forward() with zero interval in bcm_rx_thr_handler(). kt_ival2 may have been concurrently cleared by bcm_rx_setup() before it cancels this timer, so check kt_ival2 inside the bcm_rx_update_lock.

Risk And Classification

Primary CVSS: v3.1 8.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.003330000 probability, percentile 0.263530000 (date 2026-08-19)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary8.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED8.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 7595de7bc56e0e52b74e56c90f7e247bf626d628 96994180bd7b248b0cc698afe926e23fc1bda59b git Not specified
CNA Linux Linux affected fbd8fdc2b218e979cfe422b139b8f74c12419d1f caa8704a7f3cb7806331596195385437126ecb3a git Not specified
CNA Linux Linux affected 2a437b86ac5a9893c902f30ef66815bf13587bf6 a7c369e7da8203e2b5be12bbcac7b9ab2ed5b658 git Not specified
CNA Linux Linux affected 76c84c3728178b2d38d5604e399dfe8b0752645e a7eb6db1cd3f7b556a301dc1265945ad112089f7 git Not specified
CNA Linux Linux affected cc55dd28c20a6611e30596019b3b2f636819a4c0 834cbca3b12e46887f7a9b35f1981a888360ea4c git Not specified
CNA Linux Linux affected c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 19b1994069dd29478ba767de1f98f14a088198dc git Not specified
CNA Linux Linux affected c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 fc9f5ee1b073bd233d9c604e338af4ebb42cbc33 git Not specified
CNA Linux Linux affected c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 749179c2e25b95d22499ed29096b3e02d6dfd2b4 git Not specified
CNA Linux Linux affected 8f1c022541bf5a923c8d6fa483112c15250f30a4 git Not specified
CNA Linux Linux affected c4e8a172501e677ebd8ea9d9161d97dc4df56fbd git Not specified
CNA Linux Linux affected 5.10.238 5.10.265 semver Not specified
CNA Linux Linux affected 5.15.185 5.15.216 semver Not specified
CNA Linux Linux affected 6.1.141 6.1.183 semver Not specified
CNA Linux Linux affected 6.6.93 6.6.148 semver Not specified
CNA Linux Linux affected 6.12.31 6.12.101 semver Not specified
CNA Linux Linux affected 5.4.294 5.5 semver Not specified
CNA Linux Linux affected 6.14.9 6.15 semver Not specified
CNA Linux Linux affected 6.15 Not specified
CNA Linux Linux unaffected 6.15 semver Not specified
CNA Linux Linux unaffected 5.10.265 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.216 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.183 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.148 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.101 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.42 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.5 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/a7c369e7da8203e2b5be12bbcac7b9ab2ed5b658 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/749179c2e25b95d22499ed29096b3e02d6dfd2b4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a7eb6db1cd3f7b556a301dc1265945ad112089f7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/fc9f5ee1b073bd233d9c604e338af4ebb42cbc33 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/96994180bd7b248b0cc698afe926e23fc1bda59b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/caa8704a7f3cb7806331596195385437126ecb3a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/834cbca3b12e46887f7a9b35f1981a888360ea4c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/19b1994069dd29478ba767de1f98f14a088198dc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report