https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 15:41:12 +0000 https://vulnerability.circl.lu/vuln/cve-2025-38004 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>can: bcm: add locking for bcm_op runtime updates</p> <p>The CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via hrtimer. The content and also the length of the sequence can be changed resp reduced at runtime where the &#39;currframe&#39; counter is then set to zero.</p> <p>Although this appeared to be a safe operation the updates of &#39;currframe&#39; can be triggered from user space and hrtimer context in bcm_can_tx(). Anderson Nascimento created a proof of concept that triggered a KASAN slab-out-of-bounds read access which can be prevented with a spin_lock_bh.</p> <p>At the rework of bcm_can_tx() the &#39;count&#39; variable has been moved into the protected section as this variable can be modified from both contexts too.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>can: bcm: add locking for bcm_op runtime updates</p> <p>The CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via hrtimer. The content and also the length of the sequence can be changed resp reduced at runtime where the &#39;currframe&#39; counter is then set to zero.</p> <p>Although this appeared to be a safe operation the updates of &#39;currframe&#39; can be triggered from user space and hrtimer context in bcm_can_tx(). Anderson Nascimento created a proof of concept that triggered a KASAN slab-out-of-bounds read access which can be prevented with a spin_lock_bh.</p> <p>At the rework of bcm_can_tx() the &#39;count&#39; variable has been moved into the protected section as this variable can be modified from both contexts too.</p> https://vulnerability.circl.lu/vuln/cve-2025-38004