CVE-2026-23362: can: bcm: fix locking for bcm_op runtime updates
can: bcm: fix locking for bcmop runtime updates
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Configuration
Call spin_lock_init() when allocating the bcm_op in bcm_rx_setup() so the RX_RTR_FRAME path can safely use bcm_can_tx().
Linux kernel CAN BCM bcm_tx_lock initialization = spin_lock_init()
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel CAN Broadcast Manager (can/bcm) are exposed when they configure an RX_SETUP operation with the RX_RTR_FRAME flag. This path sends a predefined CAN frame in response to a matching RTR frame.
What does an attacker need to trigger the vulnerable path?
The attacker needs local access with low privileges and must be able to configure or interact with the affected CAN BCM operation. Exploitation also depends on the RX_RTR_FRAME receive path being configured and on a matching RTR CAN frame being received.
Are default CAN BCM configurations affected?
The described issue is limited to the RX_RTR_FRAME exception in an RX_SETUP operation. The provided information does not indicate that ordinary RX_SETUP filtering or default configurations trigger the affected transmit-lock path.