The vulnerability arose from insufficient locking around a CAN bus transmit buffer and timer configuration in the Linux kernel's bcm driver. Because bcm_tx_lock was not held when new frame data was staged or when 64‑bit timing values were updated, concurrent access could observe partially updated or unvalidated frames. The missing error path for memcpy_from_msg() also meant that malformed userspace frames could be copied without proper validation. These issues could lead to kernel state corruption, causing crashes or potentially providing an attacker's code execution path. The fix extends the lock usage to cover all data and timer updates and adds the missing error check. The nature of the flaw is a classic atomicity violation (lock missing) combined with improper error handling.

The affected product is the Linux kernel, all distributions deploying the generic Linux kernel that includes the bcm driver. Versions prior to the patch that introduced the extended bcm_tx_lock usage are impacted. Exact version numbers are not listed, so any kernel build that contains the bcm driver should be examined for the patch application.

Because the flaw operates in kernel space, an attacker with the ability to send crafted CAN frames or manipulate the CAN bus could exploit the race to trigger a crash. The likely attack vector is via the CAN bus interface, where an unprivileged sender could inject malformed frames that the driver would process without proper locking or validation. The EPSS score is not provided, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that no widespread active exploitation is known as of the last update. However, the lack of a lock around 64‑bit timer reads on 32‑bit platforms leaves a window for torn reads, which could be leveraged to corrupt kernel memory in a carefully timed scenario.