The bug occurs when the bcm driver releases a receive operation (rx_op) by scheduling an RCU callback that frees the op without checking the new RX_NO_AUTOTIMER flag in the timer path. A concurrent CAN frame handler can re‑arm the high‑resolution timer before the old op is freed, causing the timer to fire and dereference the deallocated memory. This results in a use‑After‑Free that can give an attacker the ability to execute arbitrary code or crash the kernel.

The vulnerability affects the Linux kernel CAN bus driver, specifically the bcm module. No specific kernel versions are listed in the data; the fix was introduced in commit f1b4e32aca08. Systems running a kernel that includes this commit, or any later kernel that implements the described workqueue‑based deallocation, are not affected. Administrators should verify whether their current kernel includes the commit or newer revisions of the bcm driver.

Exploitability requires a race between a CAN frame handler and a timer, implying that an attacker must be able to inject crafted CAN traffic or have privileged access to the system. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. Without a publicly known exploit, the risk is considered high for systems that actively process CAN traffic, especially if the attacker can drive a sustained race condition leading to a use‑After‑Free. The CVSS score of 7.8 indicates a medium‑to‑high severity vulnerability capable of granting kernel‑level code execution if exploited.