This vulnerability is a data race in the Linux kernel’s bcm CAN driver. When two CPUs simultaneously process CAN frames in a single receive operation, the bcm_rx_handler() updates shared statistics without proper synchronization. The result is an inconsistent state that can make frames_filtered larger than frames_abs, producing a negative or otherwise bogus reduction percentage in the procfs interface. The flaw does not provide a direct pathway for an attacker to read or modify privileged data, but it can impact the reliability of monitoring tools that rely on accurate CAN statistics.

All Linux kernel versions built with the bcm CAN driver that contain the unpatched bcm_rx_handler() function. The issue applies to any deployment of the supported Linux kernel at the time of the patch, regardless of distribution.

Based on the CVSS score of 5.5 and an EPSS score of less than 1% the likelihood of exploitation is considered low. The vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploitation. The attack vector requires concurrent traffic on a CAN bus and operations on at least two CPUs to trigger the data race. As the flaw only causes inaccurate traffic statistics and does not expose or modify privileged data, an attacker would be limited to gathering misleading diagnostics rather than gaining control or exfiltrating data. Consequently, the overall risk remains low, but the instability in statistics could impact monitoring tools and operational decision‑making.