CVE-2026-72114

can: bcm: validate frame length in bcm_rx_setup() for RTR replies

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: validate frame length in bcm_rx_setup() for RTR replies

bcm_tx_setup() validates cf->len against the CAN/CAN FD DLC limits before installing frames for TX_SETUP, but bcm_rx_setup() never did the same for the RTR-reply frame configured via RX_SETUP with RX_RTR_FRAME.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ffd980f976e7fd666c2e61bf8ab35107efd11828 to before cc1f9569f1c1adf74fa69d6f716a31b58a2fc6ceAffected ffd980f976e7fd666c2e61bf8ab35107efd11828 to before 204f2b232717bc470ddb9e1da1d27dd9c6ef0caaAffected ffd980f976e7fd666c2e61bf8ab35107efd11828 to before e061624c0a86c3c26a2bf017e432fbc93ad68f3aAffected ffd980f976e7fd666c2e61bf8ab35107efd11828 to before 7d966cdee006911d3957e1a4e72cb93c39cd8c1eAffected ffd980f976e7fd666c2e61bf8ab35107efd11828 to before 1b475c0c72f44622a320a4386ce9e76f85e69bc7Affected ffd980f976e7fd666c2e61bf8ab35107efd11828 to before deb6a697cce3f021e731df543597f37a5e54caabAffected ffd980f976e7fd666c2e61bf8ab35107efd11828 to before 59bfddea64159594feb62ef11b7d7a33c8ee3783Affected ffd980f976e7fd666c2e61bf8ab35107efd11828 to before 62ec41f364648be79d54d94d0d240ee326948afdAffected
LinuxLinux	2.6.25Affected before 2.6.25Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

ffd980f976e7fd666c2e61bf8ab35107efd11828 to before cc1f9569f1c1adf74fa69d6f716a31b58a2fc6ceAffected
ffd980f976e7fd666c2e61bf8ab35107efd11828 to before 204f2b232717bc470ddb9e1da1d27dd9c6ef0caaAffected
ffd980f976e7fd666c2e61bf8ab35107efd11828 to before e061624c0a86c3c26a2bf017e432fbc93ad68f3aAffected
ffd980f976e7fd666c2e61bf8ab35107efd11828 to before 7d966cdee006911d3957e1a4e72cb93c39cd8c1eAffected
ffd980f976e7fd666c2e61bf8ab35107efd11828 to before 1b475c0c72f44622a320a4386ce9e76f85e69bc7Affected
ffd980f976e7fd666c2e61bf8ab35107efd11828 to before deb6a697cce3f021e731df543597f37a5e54caabAffected
ffd980f976e7fd666c2e61bf8ab35107efd11828 to before 59bfddea64159594feb62ef11b7d7a33c8ee3783Affected
ffd980f976e7fd666c2e61bf8ab35107efd11828 to before 62ec41f364648be79d54d94d0d240ee326948afdAffected

LinuxLinux

2.6.25Affected
before 2.6.25Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.