The vulnerability arises because the bcm_rx_setup() function in the Linux kernel’s CAN bus driver does not validate the length of frames received as Remote Transmission Request (RTR) replies configured via RX_SETUP with RX_RTR_FRAME. This omission can lead to memory corruption if a malicious or malformed frame exceeds the allowable CAN/CAN FD data length. The resulting buffer overrun could enable an attacker to execute arbitrary code or crash the system, thereby compromising confidentiality, integrity, and availability.

All Linux kernel releases that include the bcm driver before the security commit that adds length validation are affected. The vulnerability is present across the entire Linux kernel distribution and applies to any system with a CAN interface using the bcm driver. Specific affected kernel versions are not enumerated in the data, so any legacy or unpatched kernel is potentially vulnerable.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that no widely known exploitation has been reported yet. However, the flaw requires that an attacker can send crafted CAN frames to the target system, which is feasible in environments where CAN traffic is exposed to untrusted devices or in physically accessible networks. Provided that the attacker controls CAN traffic, the missing length check could be leveraged to corrupt memory and achieve code execution, presenting a significant risk when the vulnerability exists.