This CVE describes a resource management weakness (CWE‑772) in the Linux kernel’s CAN bus BCM driver. After a CAN device is removed, a stale rx operation could skip re‑registration, and a stale tx operation could leave a cyclic hrtimer active. The runaway timer may repeatedly invoke the timeout handler, consuming CPU cycles and potentially injecting data into a later reused interface index. The bug also silently disables frame delivery for updated filters, disrupting normal CAN communication. The fix re‑registers the RX operation when necessary and cancels the runaway timer during device removal, preventing denial of service through resource exhaustion or unintended message injection.

Affected systems are all Linux kernel releases that contain the bcm CAN driver and have not yet applied the patch. This includes any distribution kernel version preceding the commit that implements the described changes. All systems using the bcm driver for CAN communication are potentially impacted.

The CVSS score is 7.1, indicating a moderate to high severity, while the EPSS score is less than 1%, suggesting a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. It requires local or privileged interaction, specifically removal of a CAN device that triggers stale rx or tx operations. The likely attack vector is local or privilege‑elevated, through triggering device removal and inducing a runaway timer or data injection into a reused interface index. Broad exploitation is unlikely without kernel access, but the risk of service disruption remains until the patch is applied.