CVE-2026-72125

A flaw was found in the Linux kernel's Controller Area Network CAN ISO-TP protocol. A memory corruption vulnerability, specifically a use-after-free race condition, can occur during the unregistration of a network device. This happens when the system attempts to free a socket while a CAN filter...

CVE-2026-72124

A flaw was found in the Linux kernel's Controller Area Network CAN ISO-TP transport protocol module. A race condition in the transmit TX state machine allows for unsynchronized state transitions. This can lead to a situation where a frame or timer callback operates on an outdated state, resulting...

CVE-2026-72123

A use-after-free flaw was found in the Linux kernel's CAN BCM Broadcast Manager subsystem. During RX operation teardown, a concurrent receive handler can race and re-arm the throttle timer after the operation has been scheduled for deallocation. When the deallocation completes, the timer is still...

CVE-2026-72122

A flaw was found in the CAN BCM Controller Area Network Broadcast Manager module of the Linux kernel. A race condition exists where a socket intended for a specific CAN interface can silently be reconfigured to receive messages from any interface. This occurs due to inconsistent reads of socket...

CVE-2026-72121

A flaw was found in the Linux kernel's Controller Area Network CAN Broadcom bcm driver. A race condition exists when the driver attempts to update filter and timer values simultaneously with ongoing receive operations. This can lead to the transmission of stale CAN reply frames with an incorrect...

CVE-2026-72120

A flaw was found in the Linux kernel's can: bcm module. Missing Read-Copy-Update RCU list annotations and operations can lead to improperly initialized or removed bcmop structures. This improper handling may cause system instability or a denial of service when these structures are accessed...

CVE-2026-72119

A flaw was found in the Linux kernel's Controller Area Network CAN Broadcast Manager BCM module. This vulnerability arises from a race condition where CAN frame data and timer updates can be observed in a partially updated or unvalidated state due to insufficient locking. Additionally, a missing...

CVE-2026-72118

A flaw was found in the Linux kernel's Controller Area Network CAN Broadcast Manager BCM module. A data race condition, occurring when multiple central processing units CPUs simultaneously process CAN frames, can lead to incorrect statistics being reported. This could result in a bogus or negativ...

CVE-2026-72116

A flaw was found in the Linux kernel's Broadcom Controller Area Network CAN bus driver. When a CAN device is removed, the driver may fail to properly manage its receive and transmit operations. This can lead to receive filters not being correctly re-enabled after updates, preventing expected data...

CVE-2026-72115

A flaw was found in the Linux kernel's Controller Area Network CAN Broadcast Manager BCM module. A race condition can occur when an ANYDEV receive operation, which listens on all interfaces, has an active timeout or throttle timer and receives matching frames from multiple network interfaces...

CVE-2026-72114

A flaw was found in the Linux kernel's Controller Area Network CAN Broadcom bcm driver. This vulnerability arises from insufficient validation of frame lengths when processing Remote Transmission Request RTR replies. An attacker could exploit this by sending a specially crafted RTR reply, which m...

CVE-2026-72113

A flaw was found in the Linux kernel's Controller Area Network CAN Broadcast Manager BCM module. This vulnerability arises from a missing device reference count during the removal of CAN filters. If a network device is unregistered concurrently while the BCM module attempts to remove a filter, th...

CVE-2026-73523

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The numcanms...

CVE-2026-73523 COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The numcanms...

EUVD-2026-60321

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The numcanms...

CVE-2026-73523

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The numcanms...

CVE-2026-73523

In COVESA Open1722 through 0.9.2, the num_can_msgs variable (declared uint8_t) in acf-can-listener.c truncates the -1 error return from avtp_to_can() to 255, causing a write loop to iterate 255 times over a 15-slot stack array and leak ~18 KB of adjacent stack memory as ~240 CAN frames to any bus...

CVE-2026-73523 COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The numcanms...

CVE-2026-73522 COVESA Open1722 0.9.2 Stack Buffer Overflow via avtp_to_can() in acf-can-listener

COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to write past the end of a fixed 15-slot stack array by sending a crafted UDP datagram containing more than 15 ACF-CAN messages. The avtptocan function increments its write...

kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges

A flaw was found in the Linux kernel in net/can/bcm.c in can: bcm, where an unprivileged local user can exploit this vulnerability to execute arbitrary code within the kernel, which leads to a local privilege escalation LPE. This allows the attacker to gain root privileges and take full control o...