In the Linux kernel, the following vulnerability has been resolved:
can: bcm: add locking for bcm_op runtime updates
The CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via hrtimer. The content and also the length of the sequence can be changed resp reduced at runtime where the 'currframe' counter is then set to zero.
Although this appeared to be a safe operation the updates of 'currframe' can be triggered from user space and hrtimer context in bcmcantx(). Anderson Nascimento created a proof of concept that triggered a KASAN slab-out-of-bounds read access which can be prevented with a spinlockbh.
At the rework of bcmcantx() the 'count' variable has been moved into the protected section as this variable can be modified from both contexts too.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7595de7bc56e0e52b74e56c90f7e247bf626d628",
"target": {
"file": "net/can/bcm.c",
"function": "bcm_tx_setup"
},
"id": "CVE-2025-38004-069baaa7",
"signature_type": "Function",
"digest": {
"function_hash": "260738982011948758275125517449796952388",
"length": 2940.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76c84c3728178b2d38d5604e399dfe8b0752645e",
"target": {
"file": "net/can/bcm.c",
"function": "bcm_tx_setup"
},
"id": "CVE-2025-38004-111c117a",
"signature_type": "Function",
"digest": {
"function_hash": "260738982011948758275125517449796952388",
"length": 2940.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7595de7bc56e0e52b74e56c90f7e247bf626d628",
"target": {
"file": "net/can/bcm.c",
"function": "bcm_tx_timeout_handler"
},
"id": "CVE-2025-38004-155de52f",
"signature_type": "Function",
"digest": {
"function_hash": "29779799714086834922433672754462836737",
"length": 664.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a437b86ac5a9893c902f30ef66815bf13587bf6",
"target": {
"file": "net/can/bcm.c",
"function": "bcm_tx_setup"
},
"id": "CVE-2025-38004-23cdad11",
"signature_type": "Function",
"digest": {
"function_hash": "260738982011948758275125517449796952388",
"length": 2940.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4e8a172501e677ebd8ea9d9161d97dc4df56fbd",
"target": {
"file": "net/can/bcm.c",
"function": "bcm_can_tx"
},
"id": "CVE-2025-38004-345a1000",
"signature_type": "Function",
"digest": {
"function_hash": "90251830368357789777455020504563391758",
"length": 753.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbd8fdc2b218e979cfe422b139b8f74c12419d1f",
"target": {
"file": "net/can/bcm.c"
},
"id": "CVE-2025-38004-422fcb67",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"269167290215422482988615975378815881439",
"131125983321570226023005208501134026518",
"165801253064609241717096898713249977510",
"104814851758244368092996996246483793207",
"216973913519986585911362988591784974585",
"273820740823617734952098590549894389926",
"291883485646858153676726891502141529257",
"35299042017701614500277995775908653305",
"168666119772328808619541939867084866974",
"47473988046281845343064047327837007893",
"272779423839369476016962596089256204674",
"325271937131714636792681839536234550384",
"79968439783809563294688721810797799498",
"145223640866827620750221239528835168270",
"282212526268354858137907437011547402432",
"55391299186316018872811374372667716440",
"49454952967136773399303380747812624521",
"173863691545878389069579731496278488112",
"99992954669794255113986953835500105166",
"300958582509731733681349232897859584081",
"285649303676765838674726501924932957621",
"79996600836641111791278248517202873265",
"87914093329894747098732320516505232742",
"253965457692658880826019888174133749630",
"95716963094039315164401679330988866189",
"17627850632837697916964752906083769355",
"27155070334832093967779569387258340014",
"255499311819737399248640592908632839515",
"113466544062450362606073224356502587950",
"21825120139879276842877970541708385922",
"98199810162830299273147119534740379711",
"141288098470986579245199566800333486495",
"108524337221150572155798523361478659716",
"174628362167129859365620839056538153283",
"125411494263502095580902004206724710262",
"89894346110255364860126683607165742335",
"44438231803056156934835767461393959235",
"282578662564312227254926077617026787131",
"283757595555677345514068393762080233742",
"151013935671697360185943176756101868108",
"28711275354503007719034752942324382588",
"8672283469877805615528919496777308872",
"154903652078096614843936717515964449383",
"156437320292589567326707253209924150488",
"180934369687554129438452355126495073468",
"170498448007659234637627291238927219626",
"80128991863363786797604774301781775333",
"113302563693632298542376286127626428186",
"285920788550338294520348906170266068413",
"83484113730663885813856735044852614730",
"287122354744079705414885495044319309668",
"61496931995045854884902594954589988632",
"278187368273035488835369324525884898761",
"174686947722615504371190076656400147068",
"293188007206481599945644143169162721761",
"232716958101159742922962282035435776866",
"217384224619427269897326879050783162097",
"305702392646812934924035525692488383697",
"168784782383064283241394867961919127677",
"109329952443964987181275926528199998286"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7595de7bc56e0e52b74e56c90f7e247bf626d628",
"target": {
"file": "net/can/bcm.c"
},
"id": "CVE-2025-38004-606e1d76",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"269167290215422482988615975378815881439",
"131125983321570226023005208501134026518",
"165801253064609241717096898713249977510",
"104814851758244368092996996246483793207",
"216973913519986585911362988591784974585",
"273820740823617734952098590549894389926",
"291883485646858153676726891502141529257",
"35299042017701614500277995775908653305",
"168666119772328808619541939867084866974",
"47473988046281845343064047327837007893",
"272779423839369476016962596089256204674",
"325271937131714636792681839536234550384",
"79968439783809563294688721810797799498",
"145223640866827620750221239528835168270",
"282212526268354858137907437011547402432",
"55391299186316018872811374372667716440",
"49454952967136773399303380747812624521",
"173863691545878389069579731496278488112",
"99992954669794255113986953835500105166",
"300958582509731733681349232897859584081",
"285649303676765838674726501924932957621",
"79996600836641111791278248517202873265",
"87914093329894747098732320516505232742",
"253965457692658880826019888174133749630",
"95716963094039315164401679330988866189",
"17627850632837697916964752906083769355",
"27155070334832093967779569387258340014",
"255499311819737399248640592908632839515",
"113466544062450362606073224356502587950",
"21825120139879276842877970541708385922",
"98199810162830299273147119534740379711",
"141288098470986579245199566800333486495",
"108524337221150572155798523361478659716",
"174628362167129859365620839056538153283",
"125411494263502095580902004206724710262",
"89894346110255364860126683607165742335",
"44438231803056156934835767461393959235",
"282578662564312227254926077617026787131",
"283757595555677345514068393762080233742",
"151013935671697360185943176756101868108",
"28711275354503007719034752942324382588",
"8672283469877805615528919496777308872",
"154903652078096614843936717515964449383",
"156437320292589567326707253209924150488",
"180934369687554129438452355126495073468",
"170498448007659234637627291238927219626",
"80128991863363786797604774301781775333",
"113302563693632298542376286127626428186",
"285920788550338294520348906170266068413",
"83484113730663885813856735044852614730",
"287122354744079705414885495044319309668",
"61496931995045854884902594954589988632",
"278187368273035488835369324525884898761",
"174686947722615504371190076656400147068",
"293188007206481599945644143169162721761",
"232716958101159742922962282035435776866",
"217384224619427269897326879050783162097",
"305702392646812934924035525692488383697",
"168784782383064283241394867961919127677",
"109329952443964987181275926528199998286"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4e8a172501e677ebd8ea9d9161d97dc4df56fbd",
"target": {
"file": "net/can/bcm.c"
},
"id": "CVE-2025-38004-651f03cb",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"269167290215422482988615975378815881439",
"131125983321570226023005208501134026518",
"165801253064609241717096898713249977510",
"104814851758244368092996996246483793207",
"216973913519986585911362988591784974585",
"273820740823617734952098590549894389926",
"291883485646858153676726891502141529257",
"35299042017701614500277995775908653305",
"168666119772328808619541939867084866974",
"47473988046281845343064047327837007893",
"272779423839369476016962596089256204674",
"325271937131714636792681839536234550384",
"79968439783809563294688721810797799498",
"145223640866827620750221239528835168270",
"282212526268354858137907437011547402432",
"55391299186316018872811374372667716440",
"49454952967136773399303380747812624521",
"173863691545878389069579731496278488112",
"99992954669794255113986953835500105166",
"300958582509731733681349232897859584081",
"285649303676765838674726501924932957621",
"79996600836641111791278248517202873265",
"87914093329894747098732320516505232742",
"253965457692658880826019888174133749630",
"95716963094039315164401679330988866189",
"17627850632837697916964752906083769355",
"27155070334832093967779569387258340014",
"255499311819737399248640592908632839515",
"113466544062450362606073224356502587950",
"21825120139879276842877970541708385922",
"98199810162830299273147119534740379711",
"141288098470986579245199566800333486495",
"108524337221150572155798523361478659716",
"174628362167129859365620839056538153283",
"125411494263502095580902004206724710262",
"89894346110255364860126683607165742335",
"44438231803056156934835767461393959235",
"282578662564312227254926077617026787131",
"283757595555677345514068393762080233742",
"151013935671697360185943176756101868108",
"28711275354503007719034752942324382588",
"8672283469877805615528919496777308872",
"154903652078096614843936717515964449383",
"156437320292589567326707253209924150488",
"180934369687554129438452355126495073468",
"170498448007659234637627291238927219626",
"80128991863363786797604774301781775333",
"113302563693632298542376286127626428186",
"285920788550338294520348906170266068413",
"83484113730663885813856735044852614730",
"287122354744079705414885495044319309668",
"61496931995045854884902594954589988632",
"278187368273035488835369324525884898761",
"174686947722615504371190076656400147068",
"293188007206481599945644143169162721761",
"232716958101159742922962282035435776866",
"217384224619427269897326879050783162097",
"305702392646812934924035525692488383697",
"168784782383064283241394867961919127677",
"109329952443964987181275926528199998286"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbd8fdc2b218e979cfe422b139b8f74c12419d1f",
"target": {
"file": "net/can/bcm.c",
"function": "bcm_tx_timeout_handler"
},
"id": "CVE-2025-38004-7bb49cdb",
"signature_type": "Function",
"digest": {
"function_hash": "29779799714086834922433672754462836737",
"length": 664.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76c84c3728178b2d38d5604e399dfe8b0752645e",
"target": {
"file": "net/can/bcm.c"
},
"id": "CVE-2025-38004-87b456f3",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"269167290215422482988615975378815881439",
"131125983321570226023005208501134026518",
"165801253064609241717096898713249977510",
"104814851758244368092996996246483793207",
"216973913519986585911362988591784974585",
"273820740823617734952098590549894389926",
"291883485646858153676726891502141529257",
"35299042017701614500277995775908653305",
"168666119772328808619541939867084866974",
"47473988046281845343064047327837007893",
"272779423839369476016962596089256204674",
"325271937131714636792681839536234550384",
"79968439783809563294688721810797799498",
"145223640866827620750221239528835168270",
"282212526268354858137907437011547402432",
"55391299186316018872811374372667716440",
"49454952967136773399303380747812624521",
"173863691545878389069579731496278488112",
"99992954669794255113986953835500105166",
"300958582509731733681349232897859584081",
"285649303676765838674726501924932957621",
"79996600836641111791278248517202873265",
"87914093329894747098732320516505232742",
"253965457692658880826019888174133749630",
"95716963094039315164401679330988866189",
"17627850632837697916964752906083769355",
"27155070334832093967779569387258340014",
"255499311819737399248640592908632839515",
"113466544062450362606073224356502587950",
"21825120139879276842877970541708385922",
"98199810162830299273147119534740379711",
"141288098470986579245199566800333486495",
"108524337221150572155798523361478659716",
"174628362167129859365620839056538153283",
"125411494263502095580902004206724710262",
"89894346110255364860126683607165742335",
"44438231803056156934835767461393959235",
"282578662564312227254926077617026787131",
"283757595555677345514068393762080233742",
"151013935671697360185943176756101868108",
"28711275354503007719034752942324382588",
"8672283469877805615528919496777308872",
"154903652078096614843936717515964449383",
"156437320292589567326707253209924150488",
"180934369687554129438452355126495073468",
"170498448007659234637627291238927219626",
"80128991863363786797604774301781775333",
"113302563693632298542376286127626428186",
"285920788550338294520348906170266068413",
"83484113730663885813856735044852614730",
"287122354744079705414885495044319309668",
"61496931995045854884902594954589988632",
"278187368273035488835369324525884898761",
"174686947722615504371190076656400147068",
"293188007206481599945644143169162721761",
"232716958101159742922962282035435776866",
"217384224619427269897326879050783162097",
"305702392646812934924035525692488383697",
"168784782383064283241394867961919127677",
"109329952443964987181275926528199998286"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbd8fdc2b218e979cfe422b139b8f74c12419d1f",
"target": {
"file": "net/can/bcm.c",
"function": "bcm_can_tx"
},
"id": "CVE-2025-38004-87f915ca",
"signature_type": "Function",
"digest": {
"function_hash": "90251830368357789777455020504563391758",
"length": 753.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76c84c3728178b2d38d5604e399dfe8b0752645e",
"target": {
"file": "net/can/bcm.c",
"function": "bcm_tx_timeout_handler"
},
"id": "CVE-2025-38004-8a080d5c",
"signature_type": "Function",
"digest": {
"function_hash": "29779799714086834922433672754462836737",
"length": 664.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a437b86ac5a9893c902f30ef66815bf13587bf6",
"target": {
"file": "net/can/bcm.c",
"function": "bcm_can_tx"
},
"id": "CVE-2025-38004-9d5139bb",
"signature_type": "Function",
"digest": {
"function_hash": "90251830368357789777455020504563391758",
"length": 753.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a437b86ac5a9893c902f30ef66815bf13587bf6",
"target": {
"file": "net/can/bcm.c",
"function": "bcm_tx_timeout_handler"
},
"id": "CVE-2025-38004-ae2737a9",
"signature_type": "Function",
"digest": {
"function_hash": "29779799714086834922433672754462836737",
"length": 664.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76c84c3728178b2d38d5604e399dfe8b0752645e",
"target": {
"file": "net/can/bcm.c",
"function": "bcm_can_tx"
},
"id": "CVE-2025-38004-b08bf105",
"signature_type": "Function",
"digest": {
"function_hash": "90251830368357789777455020504563391758",
"length": 753.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a437b86ac5a9893c902f30ef66815bf13587bf6",
"target": {
"file": "net/can/bcm.c"
},
"id": "CVE-2025-38004-bce2add6",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"269167290215422482988615975378815881439",
"131125983321570226023005208501134026518",
"165801253064609241717096898713249977510",
"104814851758244368092996996246483793207",
"216973913519986585911362988591784974585",
"273820740823617734952098590549894389926",
"291883485646858153676726891502141529257",
"35299042017701614500277995775908653305",
"168666119772328808619541939867084866974",
"47473988046281845343064047327837007893",
"272779423839369476016962596089256204674",
"325271937131714636792681839536234550384",
"79968439783809563294688721810797799498",
"145223640866827620750221239528835168270",
"282212526268354858137907437011547402432",
"55391299186316018872811374372667716440",
"49454952967136773399303380747812624521",
"173863691545878389069579731496278488112",
"99992954669794255113986953835500105166",
"300958582509731733681349232897859584081",
"285649303676765838674726501924932957621",
"79996600836641111791278248517202873265",
"87914093329894747098732320516505232742",
"253965457692658880826019888174133749630",
"95716963094039315164401679330988866189",
"17627850632837697916964752906083769355",
"27155070334832093967779569387258340014",
"255499311819737399248640592908632839515",
"113466544062450362606073224356502587950",
"21825120139879276842877970541708385922",
"98199810162830299273147119534740379711",
"141288098470986579245199566800333486495",
"108524337221150572155798523361478659716",
"174628362167129859365620839056538153283",
"125411494263502095580902004206724710262",
"89894346110255364860126683607165742335",
"44438231803056156934835767461393959235",
"282578662564312227254926077617026787131",
"283757595555677345514068393762080233742",
"151013935671697360185943176756101868108",
"28711275354503007719034752942324382588",
"8672283469877805615528919496777308872",
"154903652078096614843936717515964449383",
"156437320292589567326707253209924150488",
"180934369687554129438452355126495073468",
"170498448007659234637627291238927219626",
"80128991863363786797604774301781775333",
"113302563693632298542376286127626428186",
"285920788550338294520348906170266068413",
"83484113730663885813856735044852614730",
"287122354744079705414885495044319309668",
"61496931995045854884902594954589988632",
"278187368273035488835369324525884898761",
"174686947722615504371190076656400147068",
"293188007206481599945644143169162721761",
"232716958101159742922962282035435776866",
"217384224619427269897326879050783162097",
"305702392646812934924035525692488383697",
"168784782383064283241394867961919127677",
"109329952443964987181275926528199998286"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbd8fdc2b218e979cfe422b139b8f74c12419d1f",
"target": {
"file": "net/can/bcm.c",
"function": "bcm_tx_setup"
},
"id": "CVE-2025-38004-d8f0e46a",
"signature_type": "Function",
"digest": {
"function_hash": "260738982011948758275125517449796952388",
"length": 2940.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7595de7bc56e0e52b74e56c90f7e247bf626d628",
"target": {
"file": "net/can/bcm.c",
"function": "bcm_can_tx"
},
"id": "CVE-2025-38004-ec8fa086",
"signature_type": "Function",
"digest": {
"function_hash": "90251830368357789777455020504563391758",
"length": 753.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4e8a172501e677ebd8ea9d9161d97dc4df56fbd",
"target": {
"file": "net/can/bcm.c",
"function": "bcm_tx_setup"
},
"id": "CVE-2025-38004-f121b9fd",
"signature_type": "Function",
"digest": {
"function_hash": "260738982011948758275125517449796952388",
"length": 2940.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4e8a172501e677ebd8ea9d9161d97dc4df56fbd",
"target": {
"file": "net/can/bcm.c",
"function": "bcm_tx_timeout_handler"
},
"id": "CVE-2025-38004-f87584cd",
"signature_type": "Function",
"digest": {
"function_hash": "29779799714086834922433672754462836737",
"length": 664.0
},
"deprecated": false,
"signature_version": "v1"
}
]