01 Record

CVE-2025-38004

can: bcm: add locking for bcm_op runtime updates

HighPUBLISHEDCNA: Linux

CNA base score7.3 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

View raw JSON

02 Description

can: bcm: add locking for bcm_op runtime updates

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.22% probability of exploitation activity in the next 30 days.
EPSS percentile: Ranks above 13.1% of scored records. A rank, not a probability.
NVD base score: 7.1 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-07-30.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2025-06-08 10:34Z1 YR AGO

Last updated

2026-08-05 11:58Z1 MO AGO

Reserved

2025-04-16

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.3)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Weaknesses

CWE-125Out-of-bounds ReadBase

Data version

5.2

Document digest

3827441b8954c120c012eb61b4a11d3ef961932ddceda21c890510bea5a0254f

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxffd980f976e7fd666c2e61bf8ab35107efd11828 to < 8f1c022541bf5a923c8d6fa483112c15250f30a4, ffd980f976e7fd666c2e61bf8ab35107efd11828 to < 7595de7bc56e0e52b74e56c90f7e247bf626d628, ffd980f976e7fd666c2e61bf8ab35107efd11828 to < fbd8fdc2b218e979cfe422b139b8f74c12419d1f, ffd980f976e7fd666c2e61bf8ab35107efd11828 to < 2a437b86ac5a9893c902f30ef66815bf13587bf6, ffd980f976e7fd666c2e61bf8ab35107efd11828 to < 76c84c3728178b2d38d5604e399dfe8b0752645e, ffd980f976e7fd666c2e61bf8ab35107efd11828 to < cc55dd28c20a6611e30596019b3b2f636819a4c0, ffd980f976e7fd666c2e61bf8ab35107efd11828 to < c4e8a172501e677ebd8ea9d9161d97dc4df56fbd, ffd980f976e7fd666c2e61bf8ab35107efd11828 to < c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7, 2.6.25—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/8f1c022541bf5a923c8d6fa483112c15250f30a4
git.kernel.orghttps://git.kernel.org/stable/c/7595de7bc56e0e52b74e56c90f7e247bf626d628
git.kernel.orghttps://git.kernel.org/stable/c/fbd8fdc2b218e979cfe422b139b8f74c12419d1f
git.kernel.orghttps://git.kernel.org/stable/c/2a437b86ac5a9893c902f30ef66815bf13587bf6
git.kernel.orghttps://git.kernel.org/stable/c/76c84c3728178b2d38d5604e399dfe8b0752645e
git.kernel.orghttps://git.kernel.org/stable/c/cc55dd28c20a6611e30596019b3b2f636819a4c0
git.kernel.orghttps://git.kernel.org/stable/c/c4e8a172501e677ebd8ea9d9161d97dc4df56fbd
git.kernel.orghttps://git.kernel.org/stable/c/c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/10/msg00007.html

01 Record index

CVE-2025-38004

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2025-38004

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References