5.5

CVE-2025-38003

can: bcm: add missing rcu read protection for procfs content

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: add missing rcu read protection for procfs content

When the procfs content is generated for a bcm_op which is in the process
to be removed the procfs output might show unreliable data (UAF).

As the removal of bcm_op's is already implemented with rcu handling this
patch adds the missing rcu_read_lock() and makes sure the list entries
are properly removed under rcu protection.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 4.19.252 < 4.20
Linux ≫ Linux Kernel Version >= 5.4.205 < 5.4.294
Linux ≫ Linux Kernel Version >= 5.10.130 < 5.10.238
Linux ≫ Linux Kernel Version >= 5.15.54 < 5.15.185
Linux ≫ Linux Kernel Version >= 5.18.11 < 5.19
Linux ≫ Linux Kernel Version >= 5.19.1 < 6.1.141
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.93
Linux ≫ Linux Kernel Version >= 6.7 < 6.12.31
Linux ≫ Linux Kernel Version >= 6.13 < 6.14.9
Linux ≫ Linux Kernel Version 5.19 Update -
Linux ≫ Linux Kernel Version 5.19 Update rc6
Linux ≫ Linux Kernel Version 5.19 Update rc7
Linux ≫ Linux Kernel Version 5.19 Update rc8
Linux ≫ Linux Kernel Version 6.15 Update rc1
Linux ≫ Linux Kernel Version 6.15 Update rc2
Linux ≫ Linux Kernel Version 6.15 Update rc3
Linux ≫ Linux Kernel Version 6.15 Update rc4
Linux ≫ Linux Kernel Version 6.15 Update rc5
Linux ≫ Linux Kernel Version 6.15 Update rc6
Linux ≫ Linux Kernel Version 6.15 Update rc7
Debian ≫ Debian Linux Version 11.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.22% 0.126
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/19f553a1ddf260da6570ed8f8d91a8c87f49b63a
Patch
https://git.kernel.org/stable/c/659701c0b954ccdb4a916a4ad59bbc16e726d42c
Patch
https://git.kernel.org/stable/c/0622846db728a5332b917c797c733e202c4620ae
Patch
https://git.kernel.org/stable/c/6d7d458c41b98a5c1670cbd36f2923c37de51cf5
Patch
https://git.kernel.org/stable/c/1f912f8484e9c4396378c39460bbea0af681f319
Patch
https://git.kernel.org/stable/c/63567ecd99a24495208dc860d50fb17440043006
Patch
https://git.kernel.org/stable/c/7c9db92d5f0eadca30884af75c53d601edc512ee
Patch
https://git.kernel.org/stable/c/dac5e6249159ac255dad9781793dbe5908ac9ddb
Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
Third Party Advisory