The Linux kernel contains a data race in the bcm_rx_handler function, where concurrent writers can update the op->rx_stamp and op->rx_ifindex fields without acquiring the bcm_rx_update_lock. On 32‑bit platforms this race can produce a torn store of the 64‑bit rx_stamp value and misassociate the timestamp and interface index with the CAN frame that is delivered to user space. As a result, frame metadata may be corrupted, potentially leading to misdelivery or data integrity failures in applications that rely on accurate CAN timing and source identification.

All Linux kernel releases that include the bcm_rx_handler functionality before the patch commit (136de17f38630307991c59aa7080012a99451783 and subsequent associated commits). The exact affected versions are not listed in the advisory, so any distribution kernel that predates the fix is potentially vulnerable. This includes kernels that support CAN bus interfaces and use wildcard filters (ifindex == 0).

No CVSS score is reported, and EPSS data is unavailable, so the quantitative severity and exploitation probability are unknown. The vulnerability is not listed in CISA’s KEV catalog. The data race would normally require an attacker with the ability to trigger concurrent CAN frame handling—typically a local or privileged user with access to CAN sockets—although no evidence of remote exploitation is provided. Given the lack of public exploitation data, the risk is uncertain but could be moderate if the attack entry point exists within trusted components.