CVE-2026-72117

A flaw was found in the Linux kernel's CAN (Controller Area Network) Broadcast Manager (BCM) module. A data race condition exists in the bcm_rx_handler() function where the rx_stamp and rx_ifindex values are written without proper locking. This can lead to a "torn store" of the 64-bit rx_stamp on 32-bit systems, resulting in the bcm_send_to_user() function reporting incorrect timestamp or interface index information for received frames. This issue primarily affects the accuracy of metadata associated with CAN frames.

This vulnerability is rated with a Low severity because CAN networking protocols are rarely enabled in typical enterprise deployments, and the flaw only leads to inconsistent frame metadata without compromising system confidentiality or integrity. Exploitation requires local access, active CAN interfaces, and concurrent traffic across multiple devices on the same network namespace. The impact is confined to inaccurate frame timestamps or interface identifiers delivered to user-space monitoring sockets, presenting no risk of privilege escalation or denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.