CVE-2026-72119: can: bcm: extend bcm_tx_lock usage for data and timer updates
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: extend bcmtxlock usage for data and timer updates
Stage new CAN frame content for an existing tx op into a kmalloc()'d buffer and validate it there, mirroring the approach already used in bcmrxsetup(). Only copy the validated data into op->frames while holding op->bcmtxlock, so bcmcantx() and bcmtxtimeouthandler() can no longer observe a partially updated or unvalidated frame.
Add a missing error path for memcpyfrommsg() when copying CAN frame data from userspace.
Also move the ktival1/ktival2/ival1/ival2 updates in bcmtxsetup() under op->bcmtxlock, and read ktival1/ktival2/count under the same lock in bcmtxsetexpiry() and bcmtxtimeouthandler(), closing the torn 64-bit ktimet read on 32-bit platforms.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change the frame handling so that bcm_rx_setup() stages new CAN frame content into a kmalloc()'d buffer, validates it, and only then copies validated data into op->frames; do this to prevent can_no longer observing a partially updated or unvalidated frame.
Linux kernel (CAN: bcm) bcm_rx_setup() frame update flow = kmalloc-validate-copy (no direct partial updates) - Configuration
In the CAN frame copy code, add the missing error path for memcpy_from_msg() when copying a CAN frame, so failures are handled instead of continuing with invalid/partial data.
Linux kernel (CAN) memcpy_from_msg() error handling path = added missing error path - Compensating control
Ensure CAN BCM transmit/timeout paths take and hold op->bcm_tx_lock while updating and reading torn 64-bit ktime_t state: update kt_ival1/kt_ival2 (and count if applicable) in bcm_tx_setup(), and read kt_ival1/kt_ival2/count only under op->bcm_tx_lock in bcm_can_tx(), bcm_tx_timeout_handler(), and bcm_tx_set_expiry() on 32-bit platforms.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72119?
CVE-2026-72119 has a risk score of 38, indicating a moderate severity level.
How do I fix CVE-2026-72119?
To fix CVE-2026-72119, ensure you apply the latest patches provided by the Linux kernel updates.
What systems are affected by CVE-2026-72119?
CVE-2026-72119 affects the Linux kernel, specifically components related to CAN frame management.
What are the potential impacts of CVE-2026-72119?
CVE-2026-72119 could potentially lead to unintentional data corruption or system instability in affected systems.
When was CVE-2026-72119 published?
CVE-2026-72119 was published on August 15, 2026.