Linux Kernel EUVD-2026-59074

The CAN BCM (Broadcast Manager) protocol layer in the Linux kernel provides message filtering and periodic transmission scheduling for Controller Area Network interfaces, commonly used in automotive, industrial, and embedded systems. The vulnerability involves two state-management failures in socket lifecycle handling around NETDEV_UNREGISTER events. For TX ops, bcm_notify() did not cancel the active hrtimer when a CAN device was removed, allowing bcm_tx_timeout_handler() to re-arm itself indefinitely - a classic resource-not-released-on-teardown pattern. For RX ops, bcm_rx_setup() unconditionally skipped can_rx_register() on updates even when the prior registration had been silently torn down by a concurrent device removal (op->rx_reg_dev == NULL), producing silent frame-delivery loss rather than re-enabling the filter. NVD did not assign a CWE, but the root causes align with CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) for the RX race and CWE-672 (Operation on a Resource After Expiration or Release) for the TX timer issue. CPE data indicates the affected component is the can/bcm subsystem across the mainline Linux kernel tree from commit ffd980f976e7fd666c2e61bf8ab35107efd11828 onward prior to the individual stable-branch fix commits.