This vulnerability is a data race in the Linux kernel's bcm CAN driver. When two CPUs simultaneously process CAN frames in a single receive operation, the bcm_rx_handler() updates shared statistics without proper synchronization. The result is an inconsistent state that can make frames_filtered larger than frames_abs, producing a negative or otherwise bogus reduction percentage in the procfs interface. The flaw does not provide a direct pathway for an attacker to read or modify privileged data, but it can impact the reliability of monitoring tools that rely on accurate CAN statistics.

All Linux kernel versions built with the bcm CAN driver that contain the unpatched bcm_rx_handler() function. The issue applies to any deployment of the supported Linux kernel at the time of the patch, regardless of distribution.

No CVSS score is listed in the advisory, and the EPSS score is unavailable, indicating limited publicly known exploitation attempts. The bug is not present in CISA's KEV catalog. The attack vector requires concurrent traffic on a CAN bus and operations on at least two CPUs; typical environments will not exploit this condition for malicious gain, though the unstable statistics may be problematic for system diagnostics. Overall, the risk is considered low, but the lack of accurate metrics could impair operations that depend on precise traffic metrics.