{"id":"CVE-2026-72119","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-72119","summary":"can: bcm: extend bcm_tx_lock usage for data and timer updates","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: extend bcm_tx_lock usage for data and timer updates\n\nStage new CAN frame content for an existing tx op into a kmalloc()'d\nbuffer and validate it there, mirroring the approach already used in\nbcm_rx_setup(). Only copy the validated data into op->frames while\nholding op->bcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler()\ncan no longer observe a partially updated or unvalidated frame.\n\nAdd a missing error path for memcpy_from_msg() when copying CAN frame\ndata from userspace.\n\nAlso move the kt_ival1/kt_ival2/ival1/ival2 updates in bcm_tx_setup()\nunder op->bcm_tx_lock, and read kt_ival1/kt_ival2/count under the same\nlock in bcm_tx_set_expiry() and bcm_tx_timeout_handler(), closing the\ntorn 64-bit ktime_t read on 32-bit platforms.","published":"2026-08-15T05:52:58.479Z","modified":"2026-08-18T03:56:55.104320963Z","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"6.6.148"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc"},{"type":"WEB","url":"https://git.kernel.org/stable/c/337f966c00662d81ad82cf5a4bbb150b2e32c0d4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/52f06e7603780de100233713ddaf971d422e10ef"},{"type":"WEB","url":"https://git.kernel.org/stable/c/972fd66bb08fdef1090abe43196ca8da07216d13"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bd46f55dec608daa44b45dcf3328517630ad8e40"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72119.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72119"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-18T03:56:55.104320963Z"}}