CVE-2025-38004

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38004", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.977Z", "datePublished": "2025-06-08T10:34:56.484Z", "dateUpdated": "2026-10-15T21:52:06.494Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:55.616Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: add locking for bcm_op runtime updates\n\nThe CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via\nhrtimer. The content and also the length of the sequence can be changed\nresp reduced at runtime where the 'currframe' counter is then set to zero.\n\nAlthough this appeared to be a safe operation the updates of 'currframe'\ncan be triggered from user space and hrtimer context in bcm_can_tx().\nAnderson Nascimento created a proof of concept that triggered a KASAN\nslab-out-of-bounds read access which can be prevented with a spin_lock_bh.\n\nAt the rework of bcm_can_tx() the 'count' variable has been moved into\nthe protected section as this variable can be modified from both contexts\ntoo."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "baseScore": 7.3, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires a local `socket(PF_CAN, SOCK_DGRAM, CAN_BCM)` and concurrent `sendmsg()` calls; the race is between the local socket's user context and the local hrtimer softirq, with no remote input involved.\nAC:L - The attacker controls both sides of the race \u2014 arming the hrtimer with a 1 \u00b5s `ival` (allowed by `bcm_is_invalid_tv()`) to spin `bcm_can_tx()` in softirq while looping `TX_SETUP|TX_ANNOUNCE` sendmsg on another CPU; a working PoC was written and tested by the reporter.\nPR:L - `can_create()` performs no capability check and `can-bcm` is module-autoloaded on socket creation, so any unprivileged local user can reach `bcm_tx_setup()`; the required CAN netdev exists by default on automotive/industrial targets and is otherwise creatable via `unshare -Urn` plus vcan.\nUI:N - The attacker triggers the entire sequence from its own process \u2014 socket creation, timer arming, and the concurrent TX_SETUP updates \u2014 with no victim action required.\nS:U - The out-of-bounds read, the leaked pointers, and the counter underflow are all confined to the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The OOB read is not merely detected by KASAN \u2014 the stale-heap bytes are copied into an skb and looped back by `can_send(skb, 1)`, so up to 72 bytes of adjacent slab memory per iteration, including the `op->sk` and `op->rx_reg_dev` kernel pointers, are delivered to a userspace `CAN_RAW` socket, giving a repeatable heap/KASLR disclosure primitive.\nI:L - No out-of-bounds write primitive exists (`currframe` is only a read index), but the unsynchronized `op->count--` from both contexts corrupts kernel state by underflowing the u32 counter, and `op->currframe` itself is left in an invalid out-of-range state, causing the kernel to emit frames it was never instructed to send.\nA:H - The `op->count` underflow to 0xFFFFFFFF makes `bcm_tx_set_expiry()` re-arm indefinitely at a 1 \u00b5s interval, producing a persistent softirq/TX flood that starves the CPU, and the slab-out-of-bounds access panics KASAN/hardened kernels outright."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/can/bcm.c"], "versions": [{"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "8f1c022541bf5a923c8d6fa483112c15250f30a4", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "7595de7bc56e0e52b74e56c90f7e247bf626d628", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "fbd8fdc2b218e979cfe422b139b8f74c12419d1f", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "2a437b86ac5a9893c902f30ef66815bf13587bf6", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "76c84c3728178b2d38d5604e399dfe8b0752645e", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "cc55dd28c20a6611e30596019b3b2f636819a4c0", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "c4e8a172501e677ebd8ea9d9161d97dc4df56fbd", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/can/bcm.c"], "versions": [{"version": "2.6.25", "status": "affected"}, {"version": "0", "lessThan": "2.6.25", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.294", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.238", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.185", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.141", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.93", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.31", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.9", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "5.4.294"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "5.10.238"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "5.15.185"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.1.141"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.6.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.12.31"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.14.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.15"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8f1c022541bf5a923c8d6fa483112c15250f30a4"}, {"url": "https://git.kernel.org/stable/c/7595de7bc56e0e52b74e56c90f7e247bf626d628"}, {"url": "https://git.kernel.org/stable/c/fbd8fdc2b218e979cfe422b139b8f74c12419d1f"}, {"url": "https://git.kernel.org/stable/c/2a437b86ac5a9893c902f30ef66815bf13587bf6"}, {"url": "https://git.kernel.org/stable/c/76c84c3728178b2d38d5604e399dfe8b0752645e"}, {"url": "https://git.kernel.org/stable/c/cc55dd28c20a6611e30596019b3b2f636819a4c0"}, {"url": "https://git.kernel.org/stable/c/c4e8a172501e677ebd8ea9d9161d97dc4df56fbd"}, {"url": "https://git.kernel.org/stable/c/c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7"}], "title": "can: bcm: add locking for bcm_op runtime updates", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:33:04.853Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38004", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:46:49.346053Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:06.494Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:33:04.853Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38004", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:46:49.346053Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:46:49.811Z"}}], "cna": {"title": "can: bcm: add locking for bcm_op runtime updates", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires a local `socket(PF_CAN, SOCK_DGRAM, CAN_BCM)` and concurrent `sendmsg()` calls; the race is between the local socket's user context and the local hrtimer softirq, with no remote input involved.\nAC:L - The attacker controls both sides of the race \u2014 arming the hrtimer with a 1 \u00b5s `ival` (allowed by `bcm_is_invalid_tv()`) to spin `bcm_can_tx()` in softirq while looping `TX_SETUP|TX_ANNOUNCE` sendmsg on another CPU; a working PoC was written and tested by the reporter.\nPR:L - `can_create()` performs no capability check and `can-bcm` is module-autoloaded on socket creation, so any unprivileged local user can reach `bcm_tx_setup()`; the required CAN netdev exists by default on automotive/industrial targets and is otherwise creatable via `unshare -Urn` plus vcan.\nUI:N - The attacker triggers the entire sequence from its own process \u2014 socket creation, timer arming, and the concurrent TX_SETUP updates \u2014 with no victim action required.\nS:U - The out-of-bounds read, the leaked pointers, and the counter underflow are all confined to the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The OOB read is not merely detected by KASAN \u2014 the stale-heap bytes are copied into an skb and looped back by `can_send(skb, 1)`, so up to 72 bytes of adjacent slab memory per iteration, including the `op->sk` and `op->rx_reg_dev` kernel pointers, are delivered to a userspace `CAN_RAW` socket, giving a repeatable heap/KASLR disclosure primitive.\nI:L - No out-of-bounds write primitive exists (`currframe` is only a read index), but the unsynchronized `op->count--` from both contexts corrupts kernel state by underflowing the u32 counter, and `op->currframe` itself is left in an invalid out-of-range state, causing the kernel to emit frames it was never instructed to send.\nA:H - The `op->count` underflow to 0xFFFFFFFF makes `bcm_tx_set_expiry()` re-arm indefinitely at a 1 \u00b5s interval, producing a persistent softirq/TX flood that starves the CPU, and the slab-out-of-bounds access panics KASAN/hardened kernels outright."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "8f1c022541bf5a923c8d6fa483112c15250f30a4", "versionType": "git"}, {"status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "7595de7bc56e0e52b74e56c90f7e247bf626d628", "versionType": "git"}, {"status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "fbd8fdc2b218e979cfe422b139b8f74c12419d1f", "versionType": "git"}, {"status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "2a437b86ac5a9893c902f30ef66815bf13587bf6", "versionType": "git"}, {"status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "76c84c3728178b2d38d5604e399dfe8b0752645e", "versionType": "git"}, {"status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "cc55dd28c20a6611e30596019b3b2f636819a4c0", "versionType": "git"}, {"status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "c4e8a172501e677ebd8ea9d9161d97dc4df56fbd", "versionType": "git"}, {"status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7", "versionType": "git"}], "programFiles": ["net/can/bcm.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.25"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.25", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.294", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.238", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.185", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.141", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.93", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.31", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.14.9", "versionType": "semver", "lessThanOrEqual": "6.14.*"}, {"status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/can/bcm.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/8f1c022541bf5a923c8d6fa483112c15250f30a4"}, {"url": "https://git.kernel.org/stable/c/7595de7bc56e0e52b74e56c90f7e247bf626d628"}, {"url": "https://git.kernel.org/stable/c/fbd8fdc2b218e979cfe422b139b8f74c12419d1f"}, {"url": "https://git.kernel.org/stable/c/2a437b86ac5a9893c902f30ef66815bf13587bf6"}, {"url": "https://git.kernel.org/stable/c/76c84c3728178b2d38d5604e399dfe8b0752645e"}, {"url": "https://git.kernel.org/stable/c/cc55dd28c20a6611e30596019b3b2f636819a4c0"}, {"url": "https://git.kernel.org/stable/c/c4e8a172501e677ebd8ea9d9161d97dc4df56fbd"}, {"url": "https://git.kernel.org/stable/c/c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: add locking for bcm_op runtime updates\n\nThe CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via\nhrtimer. The content and also the length of the sequence can be changed\nresp reduced at runtime where the 'currframe' counter is then set to zero.\n\nAlthough this appeared to be a safe operation the updates of 'currframe'\ncan be triggered from user space and hrtimer context in bcm_can_tx().\nAnderson Nascimento created a proof of concept that triggered a KASAN\nslab-out-of-bounds read access which can be prevented with a spin_lock_bh.\n\nAt the rework of bcm_can_tx() the 'count' variable has been moved into\nthe protected section as this variable can be modified from both contexts\ntoo."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.294", "versionStartIncluding": "2.6.25"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.238", "versionStartIncluding": "2.6.25"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.185", "versionStartIncluding": "2.6.25"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.141", "versionStartIncluding": "2.6.25"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.93", "versionStartIncluding": "2.6.25"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.31", "versionStartIncluding": "2.6.25"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14.9", "versionStartIncluding": "2.6.25"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15", "versionStartIncluding": "2.6.25"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:55.616Z"}}}, "cveMetadata": {"cveId": "CVE-2025-38004", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:06.494Z", "dateReserved": "2025-04-16T04:51:23.977Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-06-08T10:34:56.484Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/can/bcm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8f1c022541bf5a923c8d6fa483112c15250f30a4", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "7595de7bc56e0e52b74e56c90f7e247bf626d628", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "fbd8fdc2b218e979cfe422b139b8f74c12419d1f", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "2a437b86ac5a9893c902f30ef66815bf13587bf6", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "76c84c3728178b2d38d5604e399dfe8b0752645e", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "cc55dd28c20a6611e30596019b3b2f636819a4c0", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "c4e8a172501e677ebd8ea9d9161d97dc4df56fbd", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/can/bcm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.25"}, {"lessThan": "2.6.25", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.294", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.238", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.185", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.141", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.93", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.31", "versionType": "semver"}, {"lessThanOrEqual": "6.14.*", "status": "unaffected", "version": "6.14.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EA06B530-8B6F-45AD-B3AC-763FA1767929", "versionEndExcluding": "5.4.294", "versionStartIncluding": "2.6.25", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0DAAEF7F-D560-47FC-8B65-20404DB82432", "versionEndExcluding": "5.10.238", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E11820B2-24BD-40A8-9E6B-5BC447252321", "versionEndExcluding": "5.15.185", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7CEA8241-A858-4009-B4EE-31C62772811A", "versionEndExcluding": "6.1.141", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "50A4A9DE-24AB-4FB4-AACD-85D8EABB0571", "versionEndExcluding": "6.6.93", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1AE98841-5774-4B45-A81C-2D188DB7E5C3", "versionEndExcluding": "6.12.31", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A9B72DD1-715C-4101-A720-1C8D70044C06", "versionEndExcluding": "6.14.9", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*", "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*", "matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*", "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*", "matchCriteriaId": "8C7B5B0E-4EEB-48F5-B4CF-0935A7633845", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*", "matchCriteriaId": "2D240580-3048-49B2-9E27-F115A9DF8224", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*", "matchCriteriaId": "90320558-E553-4EF5-8A0B-0F5D20113BD2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc7:*:*:*:*:*:*", "matchCriteriaId": "C300BA32-5854-4B59-A00A-18A402F291D0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: add locking for bcm_op runtime updates\n\nThe CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via\nhrtimer. The content and also the length of the sequence can be changed\nresp reduced at runtime where the 'currframe' counter is then set to zero.\n\nAlthough this appeared to be a safe operation the updates of 'currframe'\ncan be triggered from user space and hrtimer context in bcm_can_tx().\nAnderson Nascimento created a proof of concept that triggered a KASAN\nslab-out-of-bounds read access which can be prevented with a spin_lock_bh.\n\nAt the rework of bcm_can_tx() the 'count' variable has been moved into\nthe protected section as this variable can be modified from both contexts\ntoo."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: can: bcm: a\u00f1adir bloqueo para actualizaciones en tiempo de ejecuci\u00f3n de bcm_op El gestor de difusi\u00f3n CAN (CAN BCM) puede enviar una secuencia de tramas CAN a trav\u00e9s de hrtimer. El contenido y tambi\u00e9n la longitud de la secuencia se pueden cambiar o reducir en tiempo de ejecuci\u00f3n, donde el contador 'currframe' se establece entonces en cero. Aunque esto parec\u00eda ser una operaci\u00f3n segura, las actualizaciones de 'currframe' se pueden activar desde el espacio de usuario y el contexto de hrtimer en bcm_can_tx(). Anderson Nascimento cre\u00f3 una prueba de concepto que activ\u00f3 un acceso de lectura fuera de los l\u00edmites de KASAN slab que se puede prevenir con un spin_lock_bh. En la reelaboraci\u00f3n de bcm_can_tx() la variable 'count' se ha movido a la secci\u00f3n protegida ya que esta variable tambi\u00e9n se puede modificar desde ambos contextos."}], "id": "CVE-2025-38004", "lastModified": "2026-10-15T22:18:24.450", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.5, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-38004", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:46:49.346053Z", "version": "2.0.3"}}]}, "published": "2025-06-08T11:15:22.210", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2a437b86ac5a9893c902f30ef66815bf13587bf6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7595de7bc56e0e52b74e56c90f7e247bf626d628"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/76c84c3728178b2d38d5604e399dfe8b0752645e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8f1c022541bf5a923c8d6fa483112c15250f30a4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c4e8a172501e677ebd8ea9d9161d97dc4df56fbd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cc55dd28c20a6611e30596019b3b2f636819a4c0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fbd8fdc2b218e979cfe422b139b8f74c12419d1f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: can: bcm: add locking for bcm_op runtime updates", "id": "2370992", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370992"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\ncan: bcm: add locking for bcm_op runtime updates\nThe CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via\nhrtimer. The content and also the length of the sequence can be changed\nresp reduced at runtime where the 'currframe' counter is then set to zero.\nAlthough this appeared to be a safe operation the updates of 'currframe'\ncan be triggered from user space and hrtimer context in bcm_can_tx().\nAnderson Nascimento created a proof of concept that triggered a KASAN\nslab-out-of-bounds read access which can be prevented with a spin_lock_bh.\nAt the rework of bcm_can_tx() the 'count' variable has been moved into\nthe protected section as this variable can be modified from both contexts\ntoo."], "name": "CVE-2025-38004", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Under investigation", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-06-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38004\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38004\nhttps://lore.kernel.org/linux-cve-announce/2025060801-CVE-2025-38004-30d2@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-06-24T09:44:13.090422+00:00", "updated": "2025-06-24T09:44:13.090468+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}