CVE-2026-72119

A flaw was found in the Linux kernel's Controller Area Network (CAN) Broadcast Manager (BCM) module. This vulnerability arises from a race condition where CAN frame data and timer updates can be observed in a partially updated or unvalidated state due to insufficient locking. Additionally, a missing error handling path when copying CAN frame data from user space contributes to the issue. An attacker could potentially exploit this to cause data corruption or unexpected system behavior within the CAN BCM module.

This vulnerability is rated as Moderate severity because exploitation requires local system access to open network sockets, limiting the potential impact primarily to a denial of service rather than privilege escalation. The CAN Broadcast Manager protocol is specialized for automotive and industrial control systems and is not utilized in standard enterprise deployments. Consequently, Red Hat Enterprise Linux systems that do not run CAN-specific workloads or interfaces are not exposed to this issue in typical operational environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.