Linux EUVD-2026-15342

The vulnerability resides in the Linux kernel's CAN (Controller Area Network) Broadcast Manager module (net/can/bcm.c), which handles high-level CAN message filtering and transmission. The CAN BCM socket implementation supports both RX_SETUP (receive configuration) and TX_SETUP (transmit configuration) operations. The RX_SETUP path normally only handles incoming traffic filtering, but includes a special case: when the RX_RTR_FRAME flag is set, the kernel must send a predefined CAN frame in response to a Remote Transmission Request (RTR) frame. This transmission path uses the bcm_can_tx() function, which requires the bcm_tx_lock spinlock for thread-safe access to shared transmission state. However, while commit c2aba69d0c36 added proper spinlock initialization in the TX_SETUP path (bcm_tx_setup function), the corresponding initialization was omitted from the RX_SETUP path (bcm_rx_setup function), leaving the spinlock uninitialized when RTR frame transmission occurs. This is classified as a synchronization primitive initialization failure (CWE-667) where a critical synchronization mechanism lacks proper setup, creating potential use-before-init conditions.