CVE-2026-23362

An improper initialization of a spin lock in the Linux kernel’s CAN bus (bcm) driver can create a race condition when updating bcm_op structures with TX_SETUP commands. If the lock is omitted, concurrent access to the bcm_op may result in corrupted CAN frame configuration or stale data being transmitted, which can compromise the integrity of CAN traffic and potentially crash the kernel. This flaw does not directly expose sensitive data but can lead to inconsistent device behaviour or denial of service for applications relying on the CAN interface.

All Linux kernel distributions that ship a bcm driver version prior to the patch identified by commit c2aba69d0c36 are affected. The CNA lists the generic vendor/product pair Linux:Linux, and no specific kernel release numbers are provided, so any kernel prior to the application of this commit would be vulnerable. Users of embedded systems, automotive platforms, or other environments that utilize the CAN bus through the bcm driver may be impacted.

The vulnerability receives a CVSS base score of 5.5 indicating moderate severity, while the EPSS score is below 1% suggesting a low likelihood of exploitation. It is not included in the CISA KEV catalog, implying no known widespread exploitation. Attack exploitation is likely limited to local privileged users with access to the CAN device because no remote network vector is documented. Once patched, the risk is mitigated; before patching, a malicious local process could manipulate CAN traffic or cause instability, but no public exploits are known.