CVE-2025-38004

HIGH EPSS 10.4%

Published Jun 8, 20251y ago · Modified Jun 17, 20261w ago

7.1 CVSS 3.1

High

Published Jun 8, 2025 1y ago

Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking for bcm_op runtime updates The CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via hrtimer. The content and also the length of the sequence can be changed resp reduced at runtime where the 'currframe' counter is then set to zero. Although this appeared to be a safe operation the updates of 'currframe' can be triggered from user space and hrtimer context in bcm_can_tx(). Anderson Nascimento created a proof of concept that triggered a KASAN slab-out-of-bounds read access which can be prevented with a spin_lock_bh. At the rework of bcm_can_tx() the 'count' variable has been moved into the protected section as this variable can be modified from both contexts too.

CVSS Details

Base Score

7.1

Exploitability

1.8

Impact

5.2

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality High

Integrity None

Availability High

Threat Intelligence

EPSS Exploit Probability

10.4% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-125 Out-of-bounds Read Memory Safety

Affected Products 15

Vendor	Product	Version	Range
linux	linux_kernel	*	≥2.6.25 – <5.4.294
linux	linux_kernel	*	≥5.5 – <5.10.238
linux	linux_kernel	*	≥5.11 – <5.15.185
linux	linux_kernel	*	≥5.16 – <6.1.141
linux	linux_kernel	*	≥6.2 – <6.6.93
linux	linux_kernel	*	≥6.7 – <6.12.31
linux	linux_kernel	*	≥6.13 – <6.14.9
linux	linux_kernel	6.15	any
linux	linux_kernel	6.15	any
linux	linux_kernel	6.15	any
linux	linux_kernel	6.15	any
linux	linux_kernel	6.15	any
linux	linux_kernel	6.15	any
linux	linux_kernel	6.15	any
debian	debian_linux	11.0	any

References 10

git.kernel.org https://git.kernel.org/stable/c/2a437b86ac5a9893c902f30ef66815bf13587bf6

Patch
git.kernel.org https://git.kernel.org/stable/c/7595de7bc56e0e52b74e56c90f7e247bf626d628

Patch
git.kernel.org https://git.kernel.org/stable/c/76c84c3728178b2d38d5604e399dfe8b0752645e

Patch
git.kernel.org https://git.kernel.org/stable/c/8f1c022541bf5a923c8d6fa483112c15250f30a4

Patch
git.kernel.org https://git.kernel.org/stable/c/c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7

Patch
git.kernel.org https://git.kernel.org/stable/c/c4e8a172501e677ebd8ea9d9161d97dc4df56fbd

Patch
git.kernel.org https://git.kernel.org/stable/c/cc55dd28c20a6611e30596019b3b2f636819a4c0

Patch
git.kernel.org https://git.kernel.org/stable/c/fbd8fdc2b218e979cfe422b139b8f74c12419d1f

Patch
lists.debian.org https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html

Third Party Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html

Third Party Advisory

Remediation

git.kernel.org https://git.kernel.org/stable/c/2a437b86ac5a9893c902f30ef66815bf13587bf6

Patch
git.kernel.org https://git.kernel.org/stable/c/7595de7bc56e0e52b74e56c90f7e247bf626d628

Patch
git.kernel.org https://git.kernel.org/stable/c/76c84c3728178b2d38d5604e399dfe8b0752645e

Patch
git.kernel.org https://git.kernel.org/stable/c/8f1c022541bf5a923c8d6fa483112c15250f30a4

Patch
git.kernel.org https://git.kernel.org/stable/c/c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7

Patch
git.kernel.org https://git.kernel.org/stable/c/c4e8a172501e677ebd8ea9d9161d97dc4df56fbd

Patch
git.kernel.org https://git.kernel.org/stable/c/cc55dd28c20a6611e30596019b3b2f636819a4c0

Patch
git.kernel.org https://git.kernel.org/stable/c/fbd8fdc2b218e979cfe422b139b8f74c12419d1f

Patch