GHSA-8PFG-CF9X-G4PR

Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-19 18:32
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: extend bcm_tx_lock usage for data and timer updates

Stage new CAN frame content for an existing tx op into a kmalloc()'d buffer and validate it there, mirroring the approach already used in bcm_rx_setup(). Only copy the validated data into op->frames while holding op->bcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler() can no longer observe a partially updated or unvalidated frame.

Add a missing error path for memcpy_from_msg() when copying CAN frame data from userspace.

Also move the kt_ival1/kt_ival2/ival1/ival2 updates in bcm_tx_setup() under op->bcm_tx_lock, and read kt_ival1/kt_ival2/count under the same lock in bcm_tx_set_expiry() and bcm_tx_timeout_handler(), closing the torn 64-bit ktime_t read on 32-bit platforms.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-72119"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T06:21:26Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: extend bcm_tx_lock usage for data and timer updates\n\nStage new CAN frame content for an existing tx op into a kmalloc()\u0027d\nbuffer and validate it there, mirroring the approach already used in\nbcm_rx_setup(). Only copy the validated data into op-\u003eframes while\nholding op-\u003ebcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler()\ncan no longer observe a partially updated or unvalidated frame.\n\nAdd a missing error path for memcpy_from_msg() when copying CAN frame\ndata from userspace.\n\nAlso move the kt_ival1/kt_ival2/ival1/ival2 updates in bcm_tx_setup()\nunder op-\u003ebcm_tx_lock, and read kt_ival1/kt_ival2/count under the same\nlock in bcm_tx_set_expiry() and bcm_tx_timeout_handler(), closing the\ntorn 64-bit ktime_t read on 32-bit platforms.",
  "id": "GHSA-8pfg-cf9x-g4pr",
  "modified": "2026-08-19T18:32:27Z",
  "published": "2026-08-15T06:32:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72119"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/337f966c00662d81ad82cf5a4bbb150b2e32c0d4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/37917e432e50b7de2b64230974380132a30f7270"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/52f06e7603780de100233713ddaf971d422e10ef"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/63422347b4c782f429748b2a09cd3cf3b77e6abd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/972fd66bb08fdef1090abe43196ca8da07216d13"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a538b072ee074c9b41b9d9c15a6861a963e30755"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bd46f55dec608daa44b45dcf3328517630ad8e40"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.