In the Linux kernel, the following vulnerability has been resolved:

can: bcm: extend bcm_tx_lock usage for data and timer updates

Stage new CAN frame content for an existing tx op into a kmalloc()'d
buffer and validate it there, mirroring the approach already used in
bcm_rx_setup(). Only copy the validated data into op->frames while
holding op->bcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler()
can no longer observe a partially updated or unvalidated frame.

Add a missing error path for memcpy_from_msg() when copying CAN frame
data from userspace.

Also move the kt_ival1/kt_ival2/ival1/ival2 updates in bcm_tx_setup()
under op->bcm_tx_lock, and read kt_ival1/kt_ival2/count under the same
lock in bcm_tx_set_expiry() and bcm_tx_timeout_handler(), closing the
torn 64-bit ktime_t read on 32-bit platforms.

https://git.kernel.org/stable/c/12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc

https://git.kernel.org/stable/c/337f966c00662d81ad82cf5a4bbb150b2e32c0d4

https://git.kernel.org/stable/c/52f06e7603780de100233713ddaf971d422e10ef

https://git.kernel.org/stable/c/972fd66bb08fdef1090abe43196ca8da07216d13

https://git.kernel.org/stable/c/bd46f55dec608daa44b45dcf3328517630ad8e40

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/can/bcm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"76c84c3728178b2d38d5604e399dfe8b0752645e","lessThan":"52f06e7603780de100233713ddaf971d422e10ef","versionType":"git","status":"affected"},{"version":"cc55dd28c20a6611e30596019b3b2f636819a4c0","lessThan":"972fd66bb08fdef1090abe43196ca8da07216d13","versionType":"git","status":"affected"},{"version":"c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7","lessThan":"bd46f55dec608daa44b45dcf3328517630ad8e40","versionType":"git","status":"affected"},{"version":"c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7","lessThan":"337f966c00662d81ad82cf5a4bbb150b2e32c0d4","versionType":"git","status":"affected"},{"version":"c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7","lessThan":"12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc","versionType":"git","status":"affected"},{"version":"8f1c022541bf5a923c8d6fa483112c15250f30a4","versionType":"git","status":"affected"},{"version":"7595de7bc56e0e52b74e56c90f7e247bf626d628","versionType":"git","status":"affected"},{"version":"fbd8fdc2b218e979cfe422b139b8f74c12419d1f","versionType":"git","status":"affected"},{"version":"2a437b86ac5a9893c902f30ef66815bf13587bf6","versionType":"git","status":"affected"},{"version":"c4e8a172501e677ebd8ea9d9161d97dc4df56fbd","versionType":"git","status":"affected"},{"version":"6.6.93","lessThan":"6.6.148","versionType":"semver","status":"affected"},{"version":"6.12.31","lessThan":"6.12.101","versionType":"semver","status":"affected"},{"version":"5.4.294","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"5.10.238","lessThan":"5.11","versionType":"semver","status":"affected"},{"version":"5.15.185","lessThan":"5.16","versionType":"semver","status":"affected"},{"version":"6.1.141","lessThan":"6.2","versionType":"semver","status":"affected"},{"version":"6.14.9","lessThan":"6.15","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/can/bcm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc4","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]