01 Record

CVE-2026-23362

can: bcm: fix locking for bcm_op runtime updates

UnratedPUBLISHEDCNA: Linux

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

can: bcm: fix locking for bcm_op runtime updates

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.09% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 0.7% of scored records. A rank, not a probability.
NVD base score: 5.5 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD analysis status: Analyzed. NVD last modified this record on 2026-06-17.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-03-25 10:27Z7 MO AGO

Last updated

2026-05-23 16:04Z5 MO AGO

Reserved

2026-01-13

Assigning CNA

Linux

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-667Improper LockingClass
CWE-909Missing Initialization of ResourceClass

Data version

5.2

Document digest

cb405e09a2d801452f2e4f9ba3a7fa5ca8077739ac1ad789f14a27f03943994c

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux7595de7bc56e0e52b74e56c90f7e247bf626d628 to < 0904037e713f787d1376e1d349c3bdf6c3105881, fbd8fdc2b218e979cfe422b139b8f74c12419d1f to < c85b96eaf766d8f066b1139a17a51efa2f6627ef, 2a437b86ac5a9893c902f30ef66815bf13587bf6 to < 800f26f11ae37b17f58e0001f28a47dd75c26557, 76c84c3728178b2d38d5604e399dfe8b0752645e to < 70e951afad4c025261fe3c952d2b07237e320a01, cc55dd28c20a6611e30596019b3b2f636819a4c0 to < 8bcf2d847adb82b2c617456f6da17ac5e6c75285, c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 to < 8215ba7bc99e84e66fd6938874ec4330a9d96518, c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 to < f0c349b2c21b220af5ba19f29b885e222958d796, c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 to < c35636e91e392e1540949bbc67932167cb48bc3a, 8f1c022541bf5a923c8d6fa483112c15250f30a4, c4e8a172501e677ebd8ea9d9161d97dc4df56fbd, 5.10.238 to < 5.10.253, 5.15.185 to < 5.15.203, 6.1.141 to < 6.1.167, 6.6.93 to < 6.6.130, 6.12.31 to < 6.12.77, 5.4.294 to < 5.5, 6.14.9 to < 6.15, 6.15—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/0904037e713f787d1376e1d349c3bdf6c3105881
git.kernel.orghttps://git.kernel.org/stable/c/c85b96eaf766d8f066b1139a17a51efa2f6627ef
git.kernel.orghttps://git.kernel.org/stable/c/800f26f11ae37b17f58e0001f28a47dd75c26557
git.kernel.orghttps://git.kernel.org/stable/c/70e951afad4c025261fe3c952d2b07237e320a01
git.kernel.orghttps://git.kernel.org/stable/c/8bcf2d847adb82b2c617456f6da17ac5e6c75285
git.kernel.orghttps://git.kernel.org/stable/c/8215ba7bc99e84e66fd6938874ec4330a9d96518
git.kernel.orghttps://git.kernel.org/stable/c/f0c349b2c21b220af5ba19f29b885e222958d796
git.kernel.orghttps://git.kernel.org/stable/c/c35636e91e392e1540949bbc67932167cb48bc3a

07 Fixed in

Debian 12

linux
Fixed in 6.1.170-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.85-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 6.19.8-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.