CVE-2026-23362
EUVD-2026-1534225.03.2026, 11:16
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: fix locking for bcm_op runtime updates
Commit c2aba69d0c36 ("can: bcm: add locking for bcm_op runtime updates")
added a locking for some variables that can be modified at runtime when
updating the sending bcm_op with a new TX_SETUP command in bcm_tx_setup().
Usually the RX_SETUP only handles and filters incoming traffic with one
exception: When the RX_RTR_FRAME flag is set a predefined CAN frame is
sent when a specific RTR frame is received. Therefore the rx bcm_op uses
bcm_can_tx() which uses the bcm_tx_lock that was only initialized in
bcm_tx_setup(). Add the missing spin_lock_init() when allocating the
bcm_op in bcm_rx_setup() to handle the RTR case properly.EnginsightAffected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| linux | linux_kernel | 5.4.294 ≤ 𝑥 < 5.5 |
| linux | linux_kernel | 5.10.238 ≤ 𝑥 < 5.10.253 |
| linux | linux_kernel | 5.15.185 ≤ 𝑥 < 5.15.203 |
| linux | linux_kernel | 6.1.141 ≤ 𝑥 < 6.1.167 |
| linux | linux_kernel | 6.6.93 ≤ 𝑥 < 6.6.130 |
| linux | linux_kernel | 6.12.31 ≤ 𝑥 < 6.12.77 |
| linux | linux_kernel | 6.14.9 ≤ 𝑥 < 6.15 |
| linux | linux_kernel | 6.15.1 ≤ 𝑥 < 6.18.17 |
| linux | linux_kernel | 6.19 ≤ 𝑥 < 6.19.7 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 7.0:rc1 |
| linux | linux_kernel | 7.0:rc2 |
| linux | linux_kernel | 7.0:rc3 |
| linux | linux_kernel | 7.0:rc4 |
| linux | linux_kernel | 7.0:rc5 |
| linux | linux_kernel | 7.0:rc6 |
| linux | linux_kernel | 7.0:rc7 |
𝑥
= Vulnerable software versions
Debian Releases
openSUSE / SLES Releases
openSUSE Product | |||
|---|---|---|---|
| cluster-md-kmp-default |
| ||
| dlm-kmp-default |
| ||
| gfs2-kmp-default |
| ||
| kernel-default |
| ||
| kernel-default-base |
| ||
| kernel-default-man |
| ||
| kernel-macros |
| ||
| kernel-source |
| ||
| kernel-syms |
| ||
| ocfs2-kmp-default |
|
Common Weakness Enumeration
References