{"apiVersion":"1.0","identifier":"CVE-2026-72119","description":"In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcm_tx_lock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc()-d buffer and validate it there, mirroring the approach already used in bcm_rx_setup(). Only copy the validated data into op->frames while holding op->bcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler() can no longer observe a partially updated or unvalidated frame. Add a missing error path for memcpy_from_msg() when copying CAN frame data from userspace. Also move the kt_ival1/kt_ival2/ival1/ival2 updates in bcm_tx_setup() under op->bcm_tx_lock, and read kt_ival1/kt_ival2/count under the same lock in bcm_tx_set_expiry() and bcm_tx_timeout_handler(), closing the torn 64-bit ktime_t read on 32-bit platforms.","publishedAt":"2026-08-15T06:21:26","lastModifiedAt":"2026-08-19T17:20:58","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72119","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00164,"riskScore":0.79,"affectedProduct":"linux","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72119","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72119","en":"https://www.redsauce.net/en/cves/CVE-2026-72119","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72119","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72119","de":"https://www.redsauce.net/de/cves/CVE-2026-72119","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72119","el":"https://www.redsauce.net/el/cves/CVE-2026-72119"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72119"}}