CVE-2025-38004: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-38004 Overview

CVE-2025-38004 is an out-of-bounds read vulnerability [CWE-125] in the Linux kernel's CAN broadcast manager (CAN BCM) subsystem. The flaw stems from missing locking around runtime updates to the bcm_op structure, specifically the currframe and count variables. These fields can be modified concurrently from user space and from hrtimer context inside bcm_can_tx(), producing a race condition that a local attacker can trigger. Researcher Anderson Nascimento built a proof of concept that reliably reproduced a KASAN slab-out-of-bounds read. The vulnerability affects multiple Linux kernel versions including the 6.15 release candidates and shipped Debian kernels.

Critical Impact
A local, unprivileged process that can open a CAN BCM socket can trigger an out-of-bounds kernel read, leading to information disclosure or kernel denial of service.

Affected Products

Linux kernel (multiple stable branches, including 6.15-rc1 through 6.15-rc7)
Debian Linux 11.0
Downstream distributions shipping affected net/can/bcm.c builds

Discovery Timeline

2025-06-08 - CVE-2025-38004 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-38004

Vulnerability Analysis

The CAN broadcast manager allows user space to schedule sequences of CAN frames transmitted through hrtimer. The kernel tracks the current position in the sequence with the currframe counter and the number of remaining transmissions with count. User space can shorten a running sequence or reset currframe to zero at runtime through BCM configuration operations. The same fields are read and updated inside bcm_can_tx(), which executes in hrtimer softirq context. Without synchronization between the two contexts, currframe can advance past the reduced sequence length. This produces a slab-out-of-bounds read when the kernel dereferences the frame array using the stale index.

Root Cause

The root cause is missing mutual exclusion in net/can/bcm.c between user-space configuration paths and the hrtimer callback. Both writers can concurrently mutate bcm_op runtime state, but the code assumed the operation was safe. The fix moves the affected updates inside a spin_lock_bh protected section and relocates the count variable into the protected region because it is also written from both contexts.

Attack Vector

Exploitation requires local access and the ability to open a CAN BCM socket (PF_CAN with CAN_BCM). An attacker races configuration ioctls that reduce the sequence length against the hrtimer-driven transmission path. The resulting out-of-bounds read can leak adjacent slab memory into transmitted frames or crash the kernel, depending on allocator layout. No user interaction is required. See the upstream fix commit and the Debian LTS announcement for technical details.

Detection Methods for CVE-2025-38004

Indicators of Compromise

KASAN reports referencing bcm_can_tx or bcm_tx_timeout_handler in kernel logs
Unexpected kernel oops or panic entries citing net/can/bcm.c
Unprivileged processes opening PF_CAN sockets on hosts that do not use CAN hardware

Detection Strategies

Audit kernel version inventories against the fixed commits published on git.kernel.org and Debian's LTS advisory.
Enable KASAN on test kernels and replay CAN BCM workloads to surface latent out-of-bounds reads.
Alert on socket(AF_CAN, SOCK_DGRAM, CAN_BCM) syscalls from processes without a legitimate CAN use case using auditd or eBPF.

Monitoring Recommendations

Forward dmesg and journalctl -k output to a central log store and search for slab-out-of-bounds and bcm_ symbols.
Track kernel package versions across the fleet and flag hosts still running vulnerable builds.
Monitor for kernel crash dumps generated by kdump on production systems.

How to Mitigate CVE-2025-38004

Immediate Actions Required

Apply the vendor kernel update from your distribution that incorporates the upstream bcm_op locking fix.
On Debian systems, install the packages referenced in the Debian LTS announcement and reboot.
Restrict CAP_NET_RAW and access to CAN sockets to trusted workloads only.

Patch Information

The fix adds spin_lock_bh protection around bcm_op runtime updates and moves the count variable into the protected section. Stable branch backports are published under commits 2a437b86ac5a, 7595de7bc56e, 76c84c372817, 8f1c022541bf, c2aba69d0c36, c4e8a172501e, cc55dd28c20a, and fbd8fdc2b218 on git.kernel.org.

Workarounds

Blacklist the can_bcm kernel module on systems that do not require CAN broadcast manager functionality.
Use seccomp or LSM policies to block AF_CAN socket creation for untrusted processes.
Isolate multi-tenant workloads that expose CAN interfaces until the kernel is patched.

bash

# Disable the CAN BCM module on hosts that do not use it
echo 'blacklist can_bcm' | sudo tee /etc/modprobe.d/disable-can-bcm.conf
sudo rmmod can_bcm 2>/dev/null || true

# Verify installed kernel version after patching (Debian example)
dpkg -l | grep linux-image
uname -r