Answer in brief
CVE-2026-72119 records a High severity (CVSS 7.8) vulnerability in can: bcm: extend bcm_tx_lock usage for data and timer updates. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=76c84c3728178b2d38d5604e399dfe8b0752645e <52f06e7603780de100233713ddaf971d422e10ef || >=cc55dd28c20a6611e30596019b3b2f636819a4c0 <972fd66bb08fdef1090abe43196ca8da07216d13 || >=c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 <bd46f55dec608daa44b45dcf3328517630ad8e40 || >=c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 <337f966c00662d81ad82cf5a4bbb150b2e32c0d4 || >=c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 <12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc || 8f1c022541bf5a923c8d6fa483112c15250f30a4 || 7595de7bc56e0e52b74e56c90f7e247bf626d628 || fbd8fdc2b218e979cfe422b139b8f74c12419d1f || 2a437b86ac5a9893c902f30ef66815bf13587bf6 || c4e8a172501e677ebd8ea9d9161d97dc4df56fbd || >=6.6.93 <6.6.148 || >=6.12.31 <6.12.101 || >=5.4.294 <5.5 || >=5.10.238 <5.11 || >=5.15.185 <5.16 || >=6.1.141 <6.2 || >=6.14.9 <6.15 | 52f06e7603780de100233713ddaf971d422e10ef, 972fd66bb08fdef1090abe43196ca8da07216d13, bd46f55dec608daa44b45dcf3328517630ad8e40, 337f966c00662d81ad82cf5a4bbb150b2e32c0d4, 12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc, 6.6.148, 6.12.101, 5.5, 5.11, 5.16, 6.2, 6.15 |
| Linux/Linuxgeneric | 6.15 | Not reported |
| Linux/Linuxgeneric | >=7595de7bc56e0e52b74e56c90f7e247bf626d628 <a538b072ee074c9b41b9d9c15a6861a963e30755 || >=fbd8fdc2b218e979cfe422b139b8f74c12419d1f <63422347b4c782f429748b2a09cd3cf3b77e6abd || >=2a437b86ac5a9893c902f30ef66815bf13587bf6 <37917e432e50b7de2b64230974380132a30f7270 || >=76c84c3728178b2d38d5604e399dfe8b0752645e <52f06e7603780de100233713ddaf971d422e10ef || >=cc55dd28c20a6611e30596019b3b2f636819a4c0 <972fd66bb08fdef1090abe43196ca8da07216d13 || >=c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 <bd46f55dec608daa44b45dcf3328517630ad8e40 || >=c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 <337f966c00662d81ad82cf5a4bbb150b2e32c0d4 || >=c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 <12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc || 8f1c022541bf5a923c8d6fa483112c15250f30a4 || c4e8a172501e677ebd8ea9d9161d97dc4df56fbd || >=5.10.238 <5.10.265 || >=5.15.185 <5.15.216 || >=6.1.141 <6.1.183 || >=6.6.93 <6.6.148 || >=6.12.31 <6.12.101 || >=5.4.294 <5.5 || >=6.14.9 <6.15 | a538b072ee074c9b41b9d9c15a6861a963e30755, 63422347b4c782f429748b2a09cd3cf3b77e6abd, 37917e432e50b7de2b64230974380132a30f7270, 52f06e7603780de100233713ddaf971d422e10ef, 972fd66bb08fdef1090abe43196ca8da07216d13, bd46f55dec608daa44b45dcf3328517630ad8e40, 337f966c00662d81ad82cf5a4bbb150b2e32c0d4, 12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc, 5.10.265, 5.15.216, 6.1.183, 6.6.148, 6.12.101, 5.5, 6.15 |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcm_tx_lock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc()'d buffer and validate it there, mirroring the approach already used in bcm_rx_setup(). Only copy the validated data into op->frames while holding op->bcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler() can no longer observe a partially updated or unvalidated frame. Add a missing error path for memcpy_from_msg() when copying CAN frame data from userspace. Also move the kt_ival1/kt_ival2/ival1/ival2 updates in bcm_tx_setup() under op->bcm_tx_lock, and read kt_ival1/kt_ival2/count under the same lock in bcm_tx_set_expiry() and bcm_tx_timeout_handler(), closing the torn 64-bit ktime_t read on 32-bit platforms.
Quoted source text, attributed separately from HOL analysis.