CVE-2026-72114

A flaw was found in the Linux kernel's Controller Area Network (CAN) Broadcom (bcm) driver. This vulnerability arises from insufficient validation of frame lengths when processing Remote Transmission Request (RTR) replies. An attacker could exploit this by sending a specially crafted RTR reply, which may lead to a system crash or other unpredictable system behavior.

This vulnerability is rated as Moderate because exploitation requires local system access to open a CAN broadcast manager socket, and the primary impact is limited to a system crash leading to denial of service. Controller Area Network (CAN) interfaces are rarely utilized in standard enterprise deployments, significantly limiting real-world exposure. Furthermore, unprivileged users must be able to interact with CAN networking subsystems, meaning environments without CAN-specific workloads face negligible operational risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.