The vulnerability arises when the bcm_rx_setup() function in Linux’s CAN bus driver does not check the length of Received Remote Transmission Request (RTR) reply frames configured via RX_SETUP with RX_RTR_FRAME. A malformed frame that exceeds the allowable CAN or CAN‑FD data length can overwrite adjacent memory, creating a buffer overflow. This corruption could be exploited to gain arbitrary code execution or crash the system, compromising confidentiality, integrity, and availability.

All Linux kernel releases that include the bcm driver before the security commit adding length validation are affected. The flaw is present in the kernel’s bcm driver across the entire distribution, so any unpatched or legacy kernel with a CAN interface using bcm could be vulnerable. Specific kernel versions are not listed, but any system that has not applied the patch is potentially at risk.

The CVSS score of 7.8 indicates a high severity, while the EPSS score of <1% suggests a low probability of exploitation at the current time. The vulnerability is not listed in CISA’s KEV catalog, indicating no documented widespread attacks. However, the flaw requires an attacker to be able to inject carefully crafted CAN frames into the target system, which is feasible in environments where CAN traffic is exposed to untrusted devices or physically accessible networks. If an attacker controls traffic, the missing length check could be leveraged to corrupt memory and potentially achieve code execution, presenting a significant risk when the flaw exists.