The Linux kernel module for the CAN bus (bcm) missed a reference count on the device used for CAN filter removal. When a device is unregistered concurrently while an RX operation is pending, the module attempts to look up the device by index – a lookup that can fail if the device has already been unregistered. The lookup failure causes the CAN filter to remain and the associated bcm_op/socket structure to be freed, leaving a stale pointer. This results in a use‑after‑free that can corrupt kernel memory and trigger a crash, presenting a local denial‑of‑service vulnerability.

Any Linux distribution that includes the bcm and isotp modules before the 04d2306… commit is applied is affected. The vulnerability was present in all kernels that shipped these modules without the missing refcount and can affect both vendor‑specific kernel builds and generic distributions until the patch is installed.

The EPSS score is < 1%, indicating a low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. The CVSS score is 7.8, indicating high severity. The likely attack vector is local: an attacker must trigger device registration and unregistration of a CAN network device while the bcm module is engaged. By doing so they can exploit the race condition to cause a crash or, in a wider context, to influence kernel execution flow. Given the impact and local nature, timely patching is essential.