Linux Kernel CVE-2026-72114

The CAN (Controller Area Network) Broadcast Manager (BCM) is a Linux kernel network subsystem providing automated message scheduling and filtering for CAN bus communications, widely used in automotive and industrial embedded environments. The RTR (Remote Transmission Request) frame type allows a node to solicit data from another CAN participant; in the BCM, RX_SETUP with RX_RTR_FRAME installs a reply frame that is transmitted automatically in response to incoming RTR requests. The vulnerability arises because bcm_rx_setup() omits the cf->len bounds check against CAN DLC limits (max 8 bytes) and CAN FD DLC limits (max 64 bytes) that bcm_tx_setup() correctly enforces, consistent with an improper input validation root cause (analogous to CWE-20, though no CWE was formally assigned). A malformed length value can therefore propagate into kernel memory operations, potentially resulting in out-of-bounds reads or writes within kernel structures. The affected code traces back to commit ffd980f976e7fd666c2e61bf8ab35107efd11828, corresponding to Linux 2.6.25, meaning the flaw has persisted across approximately 17 years of kernel development.