CVE-2026-72114

HighCVSS 7.8/10Last modified Oct 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: validate frame length in bcm_rx_setup() for RTR replies

bcm_tx_setup() validates cf->len against the CAN/CAN FD DLC limits before installing frames for TX_SETUP, but bcm_rx_setup() never did the same for the RTR-reply frame configured via RX_SETUP with RX_RTR_FRAME.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= ffd980f976e7fd666c2e61bf8ab35107efd11828, < cc1f9569f1c1adf74fa69d6f716a31b58a2fc6ce; >= ffd980f976e7fd666c2e61bf8ab35107efd11828, < 204f2b232717bc470ddb9e1da1d27dd9c6ef0caa; >= ffd980f976e7fd666c2e61bf8ab35107efd11828, < e061624c0a86c3c26a2bf017e432fbc93ad68f3a; >= ffd980f976e7fd666c2e61bf8ab35107efd11828, < 7d966cdee006911d3957e1a4e72cb93c39cd8c1e; >= ffd980f976e7fd666c2e61bf8ab35107efd11828, < 1b475c0c72f44622a320a4386ce9e76f85e69bc7; >= ffd980f976e7fd666c2e61bf8ab35107efd11828, < deb6a697cce3f021e731df543597f37a5e54caab; >= ffd980f976e7fd666c2e61bf8ab35107efd11828, < 59bfddea64159594feb62ef11b7d7a33c8ee3783; >= ffd980f976e7fd666c2e61bf8ab35107efd11828, < 62ec41f364648be79d54d94d0d240ee326948afd
LinuxLinux2.6.25

References

Timeline

Published
Aug 15, 2026
Last modified
Oct 16, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-721158.1In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for ANYDEV timeout/throttle oCVE-2026-721167.1In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix stale rx/tx ops after device removal RX: an RX_SETUP updCVE-2026-72117In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() ForCVE-2026-72118In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix CAN frame rx/tx statistics KCSAN detected a data race wiCVE-2026-721197.8In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcm_tx_lock usage for data and timer updates Stage neCVE-2026-72127.3A security vulnerability has been detected in edvardlindelof notes-mcp up to 0.1.4. This affects an unknown function of the file notes_mcp.pCVE-2026-721207.8In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu list annotations and operations sashiko-bot CVE-2026-721218.8In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and timer values KCSAN deteCVE-2026-721227.3In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure CVE-2026-721237.8In the Linux kernel, the following vulnerability has been resolved: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF CoCVE-2026-721248.8In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so->rx_lock The TX stCVE-2026-721257.8In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
CVE-2026-72114: High severity, CVSS 7.8 | Vulnix