CVE-2025-38004VulnerabilityPublished 8 Jun 2025

CVE-2025-38004: Linux · Vulnerability

Affects LinuxSource CVE Database V5

Not known to be exploited.

Data as of 25 Oct 2026, 19:02 UTC

Severity

High

Rated High by the CNA (Linux) · No CVSS score from NVD or the CNA

EPSS: 0.2% chance of exploitation in 30 days – higher than 18% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 8 Jun 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

Organizations should immediately apply the official Linux kernel patches that introduce spin_lock_bh protection in the bcm_can_tx() function and move the 'count' variable into the protected critical section. For embedded and automotive Linux systems, kernel updates should be tested and deployed promptly. Where immediate patching is not feasible, organizations should restrict unprivileged user access to CAN BCM interfaces to prevent exploitation from user space. Implementing strict access controls and monitoring for unusual CAN bus activity can help detect attempts to exploit this race condition. Additionally, enabling kernel hardening features such as KASAN in development environments can assist in early detection of memory corruption issues. Vendors and integrators should review their CAN BCM usage and consider additional synchronization mechanisms if custom modifications exist. Finally, continuous monitoring of Linux kernel advisories and rapid deployment of security updates is critical to mitigate emerging risks.

Description

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking for bcm_op runtime updates The CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via hrtimer. The content and also the length of the sequence can be changed resp reduced at runtime where the 'currframe' counter is then set to zero. Although this appeared to be a safe operation the updates of 'currframe' can be triggered from user space and hrtimer context in bcm_can_tx(). Anderson Nascimento created a proof of concept that triggered a KASAN slab-out-of-bounds read access which can be prevented with a spin_lock_bh. At the rework of bcm_can_tx() the 'count' variable has been moved into the protected section as this variable can be modified from both contexts too.

Impact

For European organizations, especially those in automotive manufacturing, industrial automation, and embedded systems sectors, this vulnerability poses a significant risk. Many European countries have strong automotive industries (e.g., Germany, France, Italy) where Linux-based embedded systems with CAN bus interfaces are common. Exploitation could lead to denial of service through kernel crashes or, in worst cases, privilege escalation allowing attackers to gain control over critical systems. This could disrupt manufacturing lines, compromise vehicle safety systems, or affect industrial control systems, leading to operational downtime and safety hazards. Additionally, organizations involved in developing or deploying IoT devices with CAN interfaces could face increased risk. Given the increasing adoption of Linux in automotive ECUs and industrial controllers, the vulnerability could have broad implications for supply chain security and operational continuity in Europe.

Summary

CVE-2025-38004 is a vulnerability identified in the Linux kernel's CAN broadcast manager (CAN BCM) subsystem. The CAN BCM is responsible for managing sequences of CAN (Controller Area Network) frames, which are used extensively in automotive and industrial control systems for communication between microcontrollers and devices. The vulnerability arises from improper synchronization when updating runtime variables such as 'currframe' and 'count' within the bcm_can_tx() function. These variables track the current frame in the sequence and the count of frames to be sent, respectively. Both can be modified concurrently from user space and the high-resolution timer (hrtimer) context without adequate locking mechanisms. This race condition leads to a slab-out-of-bounds read detected by Kernel Address Sanitizer (KASAN), which indicates a potential for memory corruption. The root cause is the lack of a spin_lock_bh (bottom half spinlock) protecting these updates, allowing concurrent access and modification. The patch involves adding proper locking around these critical sections and moving the 'count' variable inside the protected region to prevent concurrent modification. Although no known exploits are currently in the wild, the vulnerability could be leveraged to cause kernel crashes or potentially escalate privileges by corrupting kernel memory. The affected versions are specific Linux kernel commits identified by their hashes, indicating this is a recent and targeted fix. Since the CAN BCM is primarily used in embedded and automotive Linux environments, the impact is more pronounced in systems relying on CAN bus communication.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 9 Jul 2025, 00:40 UTC

Technical details

References

Community reviews

Related threats