Skip to main content

Linux Kernel CVE-2026-72119

| EUVDEUVD-2026-58877 HIGH
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-8pfg-cf9x-g4pr
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Race condition requires precise concurrent timing, warranting AC:H over NVD's AC:L; AV:L and PR:L confirmed by local CAN socket requirement; C/I/A:H reflect kernel memory integrity impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 07:00 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
HIGH 7.8
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: extend bcm_tx_lock usage for data and timer updates

Stage new CAN frame content for an existing tx op into a kmalloc()'d buffer and validate it there, mirroring the approach already used in bcm_rx_setup(). Only copy the validated data into op->frames while holding op->bcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler() can no longer observe a partially updated or unvalidated frame.

Add a missing error path for memcpy_from_msg() when copying CAN frame data from userspace.

Also move the kt_ival1/kt_ival2/ival1/ival2 updates in bcm_tx_setup() under op->bcm_tx_lock, and read kt_ival1/kt_ival2/count under the same lock in bcm_tx_set_expiry() and bcm_tx_timeout_handler(), closing the torn 64-bit ktime_t read on 32-bit platforms.

AnalysisAI

Race condition and missing lock coverage in the Linux kernel CAN Broadcast Manager (BCM) subsystem expose kernel frame data and 64-bit timer values to concurrent unsynchronized access. Low-privileged local users with access to AF_CAN BCM sockets can trigger reads of partially written frame content or torn 64-bit ktime_t values - the latter specifically affecting 32-bit kernel builds - with C:H/I:H/A:H impact per the CVSS vector. No public exploit identified at time of analysis; EPSS at 0.21% (11th percentile) confirms low current exploitation activity, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The CAN (Controller Area Network) Broadcast Manager (BCM) kernel subsystem manages periodic transmission and reception of CAN frames via netlink/socket interfaces. The flaw exists in bcm_tx_setup(), which updates frame payload, count, and ktime_t interval fields (kt_ival1/kt_ival2) for active tx operations without holding the op->bcm_tx_lock spinlock. Concurrent execution paths - bcm_can_tx() (frame transmit) and bcm_tx_timeout_handler() (timer callback) - can therefore observe a partially overwritten frame buffer or, on 32-bit platforms lacking 64-bit atomic read guarantees, a torn ktime_t read yielding a nonsensical timer value. A secondary issue is an absent error path for memcpy_from_msg() during userspace CAN frame copy, allowing unvalidated data to propagate into kernel tx buffers. Root causes map to CWE-362 (Race Condition) and CWE-252 (Unchecked Return Value). Affected CPE corresponds to the mainline Linux kernel across multiple stable branches from 5.4 through 6.15.

RemediationAI

Upgrade to a patched Linux kernel version. For LTS branches, the vendor-released patch versions are 6.6.148 and 6.12.101; mainline fixes land in 7.1.5 and 7.2-rc4. Patch commits are available at https://git.kernel.org/stable/c/12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc (one stable branch), https://git.kernel.org/stable/c/337f966c00662d81ad82cf5a4bbb150b2e32c0d4, https://git.kernel.org/stable/c/52f06e7603780de100233713ddaf971d422e10ef, https://git.kernel.org/stable/c/972fd66bb08fdef1090abe43196ca8da07216d13, and https://git.kernel.org/stable/c/bd46f55dec608daa44b45dcf3328517630ad8e40. If patching is not immediately possible, restrict AF_CAN socket creation to privileged processes via an LSM policy (AppArmor, SELinux, or seccomp) denying unprivileged access to PF_CAN/AF_CAN - note this will break any user-space CAN applications running without elevated capability. Alternatively, remove or blocklist the can-bcm kernel module (rmmod can-bcm; echo 'install can-bcm /bin/false' >> /etc/modprobe.d/disable-can-bcm.conf) if CAN BCM functionality is not required, accepting loss of CAN broadcast manager capability.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72119 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy