CVE-2026-72114 can: bcm: validate frame length in bcm_rx_setup() for RTR replies
A missing length validation in the Linux kernel CAN BCM module allows attackers to cause a denial of service via malformed RTR replies.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72114?
CVE-2026-72114 is a high-severity denial of service vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: validate frame length in bcm_rx_setup() for RTR replies
bcm_tx_setup() validates cf->len against the CAN/CAN FD DLC limits before installing frames for TX_SETUP, but bcm_rx_setup() never did the same for the RTR-reply frame configured via RX_SETUP with RX_RTR_FRAME.
Which versions are affected by CVE-2026-72114?
How do I fix CVE-2026-72114?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-72114 being exploited?
There is no known exploitation of CVE-2026-72114 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72114, DEBIAN-CVE-2026-72114, GHSA-fxhv-rjvf-632g, UBUNTU-CVE-2026-72114.