This CVE patches a use-after-free in the CAN bcm.c socket implementation, but the CVSS of 7.8 masks a significant pattern: this is the third CAN socket variant found to have the same reference-counting flaw. The original fix in raw.c (commit c275a176e4b6) explicitly identified the same vulnerability in isotp.c and bcm.c, yet only raw.c was patched at that time. This is not coincidental — it reveals a structural weakness in how kernel reference-counting patterns propagate across related subsystem implementations.
The specific mechanism: when can_rx_unregister() performs a device lookup that fails due to concurrent device unregistration, it silently skips the filter removal and returns success. This leaves a dangling filter pointing at bcm_op structures that will be freed. No error is logged, no crash occurs immediately, but the freed memory becomes vulnerable to use-after-free corruption when reused. The netdevice_tracker mechanism that fixes this in raw.c provides proper reference lifecycle management, but the same pattern wasn't systematically audited across CAN socket variants.
For defenders: verify your kernel version includes the bcm.c fix (6.x mainline). More critically, treat this as evidence that isotp.c likely remains vulnerable — the commit message explicitly named it as having the same issue but no subsequent CVE or fix appears in the kernel tree. If you run CAN bus workloads, audit any isotp.c usage and consider whether the underlying device lifecycle management in your CAN socket implementations follows safe reference patterns.
The EPSS score of 0.00163 understates the practical risk for local attackers. Unlike remote exploitability scenarios where EPSS modeling applies, a local user with CAN socket access can trigger device unregistration through netlink operations, controlling the race window more precisely than external exploitation models assume. The vulnerability class — kernel use-after-free with controllable memory reuse — has historically been chained with other vulnerabilities for privilege escalation even when standalone exploitation appears difficult.