CVE-2026-72118

A flaw was found in the Linux kernel's Controller Area Network (CAN) Broadcast Manager (BCM) module. A data race condition, occurring when multiple central processing units (CPUs) simultaneously process CAN frames, can lead to incorrect statistics being reported. This could result in a bogus or negative reduction percentage in the system's process file system (procfs), potentially affecting system monitoring and integrity.

This vulnerability is rated Low impact because the race condition is confined to internal frame accounting counters exposed via procfs and does not lead to denial of service, privilege escalation, or memory corruption. Exploitation requires active CAN network interfaces receiving concurrent traffic across multiple CPU cores, a setup uncommon in typical enterprise environments. Consequently, the operational risk to standard deployments is minimal.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.