{"id":"CVE-2026-23362","state":"PUBLISHED","title":"can: bcm: fix locking for bcm_op runtime updates","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: fix locking for bcm_op runtime updates\n\nCommit c2aba69d0c36 (\"can: bcm: add locking for bcm_op runtime updates\")\nadded a locking for some variables that can be modified at runtime when\nupdating the sending bcm_op with a new TX_SETUP command in bcm_tx_setup().\n\nUsually the RX_SETUP only handles and filters incoming traffic with one\nexception: When the RX_RTR_FRAME flag is set a predefined CAN frame is\nsent when a specific RTR frame is received. Therefore the rx bcm_op uses\nbcm_can_tx() which uses the bcm_tx_lock that was only initialized in\nbcm_tx_setup(). Add the missing spin_lock_init() when allocating the\nbcm_op in bcm_rx_setup() to handle the RTR case properly.","publishedAt":"2026-03-25T10:27:45.476Z","updatedAt":"2026-05-23T16:04:37.669Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"7595de7bc56e0e52b74e56c90f7e247bf626d628","status":"affected","lessThan":"0904037e713f787d1376e1d349c3bdf6c3105881","versionType":"git"},{"version":"fbd8fdc2b218e979cfe422b139b8f74c12419d1f","status":"affected","lessThan":"c85b96eaf766d8f066b1139a17a51efa2f6627ef","versionType":"git"},{"version":"2a437b86ac5a9893c902f30ef66815bf13587bf6","status":"affected","lessThan":"800f26f11ae37b17f58e0001f28a47dd75c26557","versionType":"git"},{"version":"76c84c3728178b2d38d5604e399dfe8b0752645e","status":"affected","lessThan":"70e951afad4c025261fe3c952d2b07237e320a01","versionType":"git"},{"version":"cc55dd28c20a6611e30596019b3b2f636819a4c0","status":"affected","lessThan":"8bcf2d847adb82b2c617456f6da17ac5e6c75285","versionType":"git"},{"version":"c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7","status":"affected","lessThan":"8215ba7bc99e84e66fd6938874ec4330a9d96518","versionType":"git"},{"version":"c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7","status":"affected","lessThan":"f0c349b2c21b220af5ba19f29b885e222958d796","versionType":"git"},{"version":"c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7","status":"affected","lessThan":"c35636e91e392e1540949bbc67932167cb48bc3a","versionType":"git"},{"version":"8f1c022541bf5a923c8d6fa483112c15250f30a4","status":"affected","versionType":"git"},{"version":"c4e8a172501e677ebd8ea9d9161d97dc4df56fbd","status":"affected","versionType":"git"},{"version":"5.10.238","status":"affected","lessThan":"5.10.253","versionType":"semver"},{"version":"5.15.185","status":"affected","lessThan":"5.15.203","versionType":"semver"},{"version":"6.1.141","status":"affected","lessThan":"6.1.167","versionType":"semver"},{"version":"6.6.93","status":"affected","lessThan":"6.6.130","versionType":"semver"},{"version":"6.12.31","status":"affected","lessThan":"6.12.77","versionType":"semver"},{"version":"5.4.294","status":"affected","lessThan":"5.5","versionType":"semver"},{"version":"6.14.9","status":"affected","lessThan":"6.15","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/can/bcm.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.15","versionType":"semver"},{"version":"5.10.253","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.203","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.167","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.130","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.77","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.17","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.7","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/can/bcm.c"]}],"references":["https://git.kernel.org/stable/c/0904037e713f787d1376e1d349c3bdf6c3105881","https://git.kernel.org/stable/c/c85b96eaf766d8f066b1139a17a51efa2f6627ef","https://git.kernel.org/stable/c/800f26f11ae37b17f58e0001f28a47dd75c26557","https://git.kernel.org/stable/c/70e951afad4c025261fe3c952d2b07237e320a01","https://git.kernel.org/stable/c/8bcf2d847adb82b2c617456f6da17ac5e6c75285","https://git.kernel.org/stable/c/8215ba7bc99e84e66fd6938874ec4330a9d96518","https://git.kernel.org/stable/c/f0c349b2c21b220af5ba19f29b885e222958d796","https://git.kernel.org/stable/c/c35636e91e392e1540949bbc67932167cb48bc3a"],"weaknesses":[],"ingestedAt":"2026-10-29T20:11:21.040Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/23xxx/CVE-2026-23362.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-23362","state":"PUBLISHED","datePublished":"2026-03-25T10:27:45.476Z","dateUpdated":"2026-05-23T16:04:37.669Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-01-13T15:37:46.002Z"},"containers":{"cna":{"title":"can: bcm: fix locking for bcm_op runtime updates","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: fix locking for bcm_op runtime updates\n\nCommit c2aba69d0c36 (\"can: bcm: add locking for bcm_op runtime updates\")\nadded a locking for some variables that can be modified at runtime when\nupdating the sending bcm_op with a new TX_SETUP command in bcm_tx_setup().\n\nUsually the RX_SETUP only handles and filters incoming traffic with one\nexception: When the RX_RTR_FRAME flag is set a predefined CAN frame is\nsent when a specific RTR frame is received. Therefore the rx bcm_op uses\nbcm_can_tx() which uses the bcm_tx_lock that was only initialized in\nbcm_tx_setup(). Add the missing spin_lock_init() when allocating the\nbcm_op in bcm_rx_setup() to handle the RTR case properly."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"7595de7bc56e0e52b74e56c90f7e247bf626d628","status":"affected","lessThan":"0904037e713f787d1376e1d349c3bdf6c3105881","versionType":"git"},{"version":"fbd8fdc2b218e979cfe422b139b8f74c12419d1f","status":"affected","lessThan":"c85b96eaf766d8f066b1139a17a51efa2f6627ef","versionType":"git"},{"version":"2a437b86ac5a9893c902f30ef66815bf13587bf6","status":"affected","lessThan":"800f26f11ae37b17f58e0001f28a47dd75c26557","versionType":"git"},{"version":"76c84c3728178b2d38d5604e399dfe8b0752645e","status":"affected","lessThan":"70e951afad4c025261fe3c952d2b07237e320a01","versionType":"git"},{"version":"cc55dd28c20a6611e30596019b3b2f636819a4c0","status":"affected","lessThan":"8bcf2d847adb82b2c617456f6da17ac5e6c75285","versionType":"git"},{"version":"c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7","status":"affected","lessThan":"8215ba7bc99e84e66fd6938874ec4330a9d96518","versionType":"git"},{"version":"c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7","status":"affected","lessThan":"f0c349b2c21b220af5ba19f29b885e222958d796","versionType":"git"},{"version":"c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7","status":"affected","lessThan":"c35636e91e392e1540949bbc67932167cb48bc3a","versionType":"git"},{"version":"8f1c022541bf5a923c8d6fa483112c15250f30a4","status":"affected","versionType":"git"},{"version":"c4e8a172501e677ebd8ea9d9161d97dc4df56fbd","status":"affected","versionType":"git"},{"version":"5.10.238","status":"affected","lessThan":"5.10.253","versionType":"semver"},{"version":"5.15.185","status":"affected","lessThan":"5.15.203","versionType":"semver"},{"version":"6.1.141","status":"affected","lessThan":"6.1.167","versionType":"semver"},{"version":"6.6.93","status":"affected","lessThan":"6.6.130","versionType":"semver"},{"version":"6.12.31","status":"affected","lessThan":"6.12.77","versionType":"semver"},{"version":"5.4.294","status":"affected","lessThan":"5.5","versionType":"semver"},{"version":"6.14.9","status":"affected","lessThan":"6.15","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/can/bcm.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.15","versionType":"semver"},{"version":"5.10.253","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.203","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.167","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.130","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.77","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.17","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.7","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/can/bcm.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/0904037e713f787d1376e1d349c3bdf6c3105881"},{"url":"https://git.kernel.org/stable/c/c85b96eaf766d8f066b1139a17a51efa2f6627ef"},{"url":"https://git.kernel.org/stable/c/800f26f11ae37b17f58e0001f28a47dd75c26557"},{"url":"https://git.kernel.org/stable/c/70e951afad4c025261fe3c952d2b07237e320a01"},{"url":"https://git.kernel.org/stable/c/8bcf2d847adb82b2c617456f6da17ac5e6c75285"},{"url":"https://git.kernel.org/stable/c/8215ba7bc99e84e66fd6938874ec4330a9d96518"},{"url":"https://git.kernel.org/stable/c/f0c349b2c21b220af5ba19f29b885e222958d796"},{"url":"https://git.kernel.org/stable/c/c35636e91e392e1540949bbc67932167cb48bc3a"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-23T16:04:37.669Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.238","versionEndExcluding":"5.10.253"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.185","versionEndExcluding":"5.15.203"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.141","versionEndExcluding":"6.1.167"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.93","versionEndExcluding":"6.6.130"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.31","versionEndExcluding":"6.12.77"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"6.18.17"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"6.19.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"7.0"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.294"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14.9"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}