The Linux kernel CAN bus (bcm) driver omitted proper RCU list initialization and removal in bcm_[rx|tx]_setup() and bcm_release(). The missing use of list_add_rcu() caused bcm_op structures to be traversed under rcu_read_lock while still uninitialized, and the removal path freed ops that were still linked without unlinking. These issues can lead to a use‑after‑free condition and associated memory corruption, potentially causing kernel crashes or a denial of service if the affected code paths are exercised.

All Linux kernel versions that contain the bcm CAN bus driver before the commit that introduces list_add_rcu() and list_del_rcu() calls are vulnerable. The vulnerability applies to any kernel that includes the bcm driver before the fixes reflected in the referenced commit hashes (e.g., 30f7bb922cb7e7f072a56c7cb7a5efccd2ceca1d). No specific version range is provided; therefore, any kernel with the driver before the listed commits could be affected.

The EPSS score is < 1%, indicating a very low probability of exploitation. The CVSS score of 7.8 highlights high severity, with potential for kernel crashes or denial of service. The vulnerability is not listed in CISA KEV. Exploitation would likely require local or privileged access to load or interact with the bcm driver and trigger the bcm_proc_show or bcm_release paths. No publicly known exploits exist, so the overall risk remains moderate for typical environments, though a use‑after‑free can cause a kernel crash if the affected code is exercised.