CVE-2026-72114 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: validate frame length in bcm_rx_setup() for RTR replies
bcm_tx_setup() validates cf->len against the CAN/CAN FD DLC limits before installing frames for TX_SETUP, but bcm_rx_setup() never did the same for the RTR-reply frame configured via RX_SETUP with RX_RTR_FRAME.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability identified in the Linux kernel's can bcm subsystem represents a critical validation gap that could enable improper frame handling during CAN bus communication operations. This issue specifically affects the broadcast manager component responsible for managing CAN frames between userspace applications and the kernel's CAN subsystem. The flaw manifests when processing receive setup requests that configure RTR (Remote Transmission Request) replies, where the system fails to validate the frame length against established CAN and CAN FD DLC (Data Length Code) limits.
The technical implementation of this vulnerability stems from inconsistent validation practices within the bcm subsystem functions. While bcm_tx_setup() properly validates the frame length contained in cf->len parameter against the appropriate CAN/CAN FD DLC constraints before installing frames for transmission setup operations, the bcm_rx_setup() function neglects to perform the same validation when handling receive setup requests that configure RTR replies through RX_SETUP with RX_RTR_FRAME flags. This discrepancy creates a potential attack surface where malformed frame lengths could be accepted and processed without proper boundary checking, leading to possible memory corruption or undefined behavior within kernel space.
The operational impact of this vulnerability extends beyond simple validation failure, potentially allowing malicious actors to exploit the inconsistent validation logic during CAN bus communication setup operations. When an application configures RTR replies through RX_SETUP with RX_RTR_FRAME flags, the kernel accepts potentially invalid frame length values that could cause buffer overflows or other memory safety issues during subsequent frame processing. This vulnerability directly relates to CWE-129 Input Validation and CWE-787 Out-of-bounds Write, as the system fails to validate array indices or buffer sizes before use, creating opportunities for memory corruption attacks.
From an attack perspective, this vulnerability aligns with ATT&CK technique T1059 Command and Scripting Interpreter where malicious actors could potentially leverage kernel-level memory corruption to escalate privileges or gain unauthorized access to CAN bus communication channels. The vulnerability affects systems utilizing the Linux kernel's CAN subsystem, particularly those implementing broadcast manager functionality for CAN bus operations. Security researchers should note that this issue represents a classic case of incomplete validation patterns within kernel code, where similar validation gaps may exist in other subsystems requiring consistent input sanitization across all code paths.
The recommended mitigations involve implementing consistent length validation across both bcm_tx_setup() and bcm_rx_setup() functions to ensure that cf->len values are validated against CAN/CAN FD DLC limits regardless of the frame processing direction. Kernel updates should enforce proper bounds checking for all frame lengths during receive setup operations, particularly when handling RTR reply configurations. System administrators should ensure immediate patching of affected kernel versions while monitoring CAN bus communication for any anomalous behavior that might indicate exploitation attempts. Organizations utilizing embedded systems or automotive platforms relying on CAN bus communications should conduct comprehensive security assessments to identify potential variants of this validation pattern across their kernel implementations and other subsystems requiring similar frame handling operations.