In the Linux kernel CAN bus driver, reads of bo->bound and bo->ifindex without synchronization can occur while write operations are protected by a lock. The result is that a socket that was bound to a specific CAN interface may inadvertently match any interface, effectively erasing the intended binding. This race condition also causes the bcm_rx_setup routine to report success when the target device disappears concurrently, leaving a broken receive operation registered as successful. The weakened state can lead to unreliable communication on the bus and potential denial‑of‑service scenarios for applications relying on precise interface binding.

The flaw is present in the bcm module of the Linux kernel. All kernel releases that include the unmanaged bcm driver and lack the subsequent commit awaiting the fix. The exact affected version range is not specified, but any kernel built with the older bcm implementation is subject to the race before the patch was merged.

The vulnerability requires the attacker to have concurrent access to the same CAN socket within a process to exploit the race. As the data only affects binding and internal state, it does not grant privilege escalation or remote code execution. The EPSS score is < 1% and the issue is not listed in the CISA KEV catalog, indicating a low but non‑zero likelihood of exploitation. The CVSS score of 7.3 classifies the flaw as high severity, and users should treat it as a high‑severity bug that could disrupt CAN communication in environments where multiple threads share socket handles.