CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

CVE-2025-38003: can: bcm: add missing rcu read protection for procfs content

Description

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: add missing rcu read protection for procfs content

When the procfs content is generated for a bcm_op which is in the process
to be removed the procfs output might show unreliable data (UAF).

As the removal of bcm_op's is already implemented with rcu handling this
patch adds the missing rcu_read_lock() and makes sure the list entries
are properly removed under rcu protection.

Classification

CVE ID: CVE-2025-38003

Affected Products

Vendor: Linux

Product: Linux

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.03% (probability of being exploited)

EPSS Percentile: 7.51% (scored less or equal to compared to others)

EPSS Date: 2025-06-27 (when was this score calculated)

References

Timeline

2025-06-08 11:40:10 UTC
CVE

can: bcm: add missing rcu read protection for procfs content