CVE-2026-72119

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-72119

Key Details

CVE	CVE-2026-72119
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: extend bcm_tx_lock usage for data and timer updates

Stage new CAN frame content for an existing tx op into a kmalloc()'d

buffer and validate it there, mirroring the approach already used in

bcm_rx_setup(). Only copy the validated data into op->frames while

holding op->bcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler()

can no longer observe a partially updated or unvalidated frame.

Add a missing error path for memcpy_from_msg() when copying CAN frame

data from userspace.

Also move the kt_ival1/kt_ival2/ival1/ival2 updates in bcm_tx_setup()

under op->bcm_tx_lock, and read kt_ival1/kt_ival2/count under the same

lock in bcm_tx_set_expiry() and bcm_tx_timeout_handler(), closing the

torn 64-bit ktime_t read on 32-bit platforms. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-72119
CVE	https://www.cve.org/CVERecord?id=CVE-2026-72119

Source

Reference

NVD

CVE