{"id":"CVE-2026-72119","title":"can: bcm: extend bcm_tx_lock usage for data and timer updates","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: extend bcm_tx_lock usage for data and timer updates\n\nStage new CAN frame content for an existing tx op into a kmalloc()'d\nbuffer and validate it there, mirror…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 7595de7bc56e0e52b74e56c90f7e247bf626d628 < a538b072ee074c9b41b9d9c15a6861a963e30755","Linux >= fbd8fdc2b218e979cfe422b139b8f74c12419d1f < 63422347b4c782f429748b2a09cd3cf3b77e6abd","Linux >= 2a437b86ac5a9893c902f30ef66815bf13587bf6 < 37917e432e50b7de2b64230974380132a30f7270","Linux >= 76c84c3728178b2d38d5604e399dfe8b0752645e < 52f06e7603780de100233713ddaf971d422e10ef","Linux >= cc55dd28c20a6611e30596019b3b2f636819a4c0 < 972fd66bb08fdef1090abe43196ca8da07216d13","Linux >= c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 < bd46f55dec608daa44b45dcf3328517630ad8e40","Linux >= c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 < 337f966c00662d81ad82cf5a4bbb150b2e32c0d4","Linux >= c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 < 12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc","Linux 8f1c022541bf5a923c8d6fa483112c15250f30a4","Linux c4e8a172501e677ebd8ea9d9161d97dc4df56fbd","Linux >= 5.10.238 < 5.10.265","Linux >= 5.15.185 < 5.15.216","Linux >= 6.1.141 < 6.1.183","Linux >= 6.6.93 < 6.6.148","Linux >= 6.12.31 < 6.12.101","Linux >= 5.4.294 < 5.5","Linux >= 6.14.9 < 6.15","Linux 6.15"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T18:41:54.989414Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T18:44:56.991Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72119","references":[{"url":"https://git.kernel.org/stable/c/a538b072ee074c9b41b9d9c15a6861a963e30755"},{"url":"https://git.kernel.org/stable/c/63422347b4c782f429748b2a09cd3cf3b77e6abd"},{"url":"https://git.kernel.org/stable/c/37917e432e50b7de2b64230974380132a30f7270"},{"url":"https://git.kernel.org/stable/c/52f06e7603780de100233713ddaf971d422e10ef"},{"url":"https://git.kernel.org/stable/c/972fd66bb08fdef1090abe43196ca8da07216d13"},{"url":"https://git.kernel.org/stable/c/bd46f55dec608daa44b45dcf3328517630ad8e40"},{"url":"https://git.kernel.org/stable/c/337f966c00662d81ad82cf5a4bbb150b2e32c0d4"},{"url":"https://git.kernel.org/stable/c/12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc"}],"tags":["cve.org"],"epss":0.00169,"epssPercentile":0.05786,"ingestedAt":"2026-10-16T19:46:24.432Z","slug":"CVE-2026-72119","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: extend bcm_tx_lock usage for data and timer updates\n\nStage new CAN frame content for an existing tx op into a kmalloc()'d\nbuffer and validate it there, mirroring the approach already used in\nbcm_rx_setup(). Only copy the validated data into op->frames while\nholding op->bcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler()\ncan no longer observe a partially updated or unvalidated frame.\n\nAdd a missing error path for memcpy_from_msg() when copying CAN frame\ndata from userspace.\n\nAlso move the kt_ival1/kt_ival2/ival1/ival2 updates in bcm_tx_setup()\nunder op->bcm_tx_lock, and read kt_ival1/kt_ival2/count under the same\nlock in bcm_tx_set_expiry() and bcm_tx_timeout_handler(), closing the\ntorn 64-bit ktime_t read on 32-bit platforms.\n\n## Affected\n\n- `Linux >= 7595de7bc56e0e52b74e56c90f7e247bf626d628 < a538b072ee074c9b41b9d9c15a6861a963e30755`\n- `Linux >= fbd8fdc2b218e979cfe422b139b8f74c12419d1f < 63422347b4c782f429748b2a09cd3cf3b77e6abd`\n- `Linux >= 2a437b86ac5a9893c902f30ef66815bf13587bf6 < 37917e432e50b7de2b64230974380132a30f7270`\n- `Linux >= 76c84c3728178b2d38d5604e399dfe8b0752645e < 52f06e7603780de100233713ddaf971d422e10ef`\n- `Linux >= cc55dd28c20a6611e30596019b3b2f636819a4c0 < 972fd66bb08fdef1090abe43196ca8da07216d13`\n- `Linux >= c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 < bd46f55dec608daa44b45dcf3328517630ad8e40`\n- `Linux >= c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 < 337f966c00662d81ad82cf5a4bbb150b2e32c0d4`\n- `Linux >= c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 < 12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc`\n- `Linux 8f1c022541bf5a923c8d6fa483112c15250f30a4`\n- `Linux c4e8a172501e677ebd8ea9d9161d97dc4df56fbd`\n- `Linux >= 5.10.238 < 5.10.265`\n- `Linux >= 5.15.185 < 5.15.216`\n- `Linux >= 6.1.141 < 6.1.183`\n- `Linux >= 6.6.93 < 6.6.148`\n- `Linux >= 6.12.31 < 6.12.101`\n- `Linux >= 5.4.294 < 5.5`\n- `Linux >= 6.14.9 < 6.15`\n- `Linux 6.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}