CVE-2026-72114

HighCVSS 7.8

Published: 15/08/2026(UTC)Updated: 19/08/2026(UTC)Translated: 15/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

In the Linux kernel, the CAN BCM module lacks frame length validation in bcm_rx_setup() for RTR replies. bcm_tx_setup() validates frame length, but bcm_rx_setup() does not, which can lead to incorrect data.

Risk Assessment

Missing validation can lead to improper processing of RTR frames, potentially disrupting CAN systems.

Recommendation

Apply the kernel patch that adds frame length validation in bcm_rx_setup() for RTR replies.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcm_rx_setup() for RTR replies bcm_tx_setup() validates cf->len against the CAN/CAN FD DLC limits before installing frames for TX_SETUP, but bcm_rx_setup() never did the same for the RTR-reply frame configured via RX_SETUP with RX_RTR_FRAME.