The bcm_release function in net/can/bcm.c in the Linux kernel before 2.6.39-rc6 does not properly validate a socket data structure, which a…

published 2011-05-09 15 y ago modified 2026-06-16 4 mo ago also EUVD-2011-1598

cvss: 4.9; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 36%
public exploits: 0; none known

The bcm_release function in net/can/bcm.c in the Linux kernel before 2.6.39-rc6 does not properly validate a socket data structure, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted release operation.

Patch / fix

fixed in 1 distros 1

linux linux_kernel 2.6.39

kernel RHEL 6 2.6.32-131.2.1.el6
perf RHEL 6 2.6.32-131.2.1.el6
kernel-kdump RHEL 6 2.6.32-131.2.1.el6
kernel-firmware RHEL 6 2.6.32-131.2.1.el6
kernel-bootwrapper RHEL 6 2.6.32-131.2.1.el6
kernel-debuginfo-common-i686 RHEL 6 2.6.32-131.2.1.el6
kernel-debuginfo-common-ppc64 RHEL 6 2.6.32-131.2.1.el6
kernel-debuginfo-common-s390x RHEL 6 2.6.32-131.2.1.el6

red hat advisories RHSA-2011:0836 RHSA-2011:1253

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2011-1598 updated 2025-11-21 cvss 4.9

kernel: missing check in can/bcm and can/raw socket releases

Red Hat Enterprise MRG 1 kernel-rt
affected: no fix available
Red Hat Enterprise Linux Server (v. 6) perf 2.6.32-131.2.1.el6, kernel 2.6.32-131.2.1.el6, kernel-kdump 2.6.32-131.2.1.el6, kernel-firmware 2.6.32-131.2.1.el6, kernel-bootwrapper 2.6.32-131.2.1.el6, kernel-debuginfo-common-i686 2.6.32-131.2.1.el6, +3 more
fixed: vendor fix RHSA-2011:0836
Red Hat MRG Realtime for RHEL 6 Server v.2 kernel-rt 2.6.33.9-rt31.75.el6rt, kernel-rt-trace 2.6.33.9-rt31.75.el6rt, kernel-rt-vanilla 2.6.33.9-rt31.75.el6rt, kernel-rt-firmware 2.6.33.9-rt31.75.el6rt, kernel-rt-debuginfo-common-x86_64 2.6.33.9-rt31.75.el6rt
fixed: vendor fix RHSA-2011:1253

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	2.0	4.9	AV:L/AC:L/Au:N/C:N/I:N/A:C

Classification

Weakness

CWE-476 NULL Pointer Dereference

Technology feeds

Linux kernel rss critical rss

References

openwall.com /lists/oss-security/2011/04/21/1
mailing-list, third-party-advisory
openwall.com /lists/oss-security/2011/04/20/7
mailing-list, third-party-advisory
openwall.com /lists/oss-security/2011/04/25/4
mailing-list, third-party-advisory
git.kernel.org /?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c6914a6f261aca0c9f715f883a353ae7ff51fe83
openwall.com /lists/oss-security/2011/04/21/7
mailing-list, third-party-advisory
kernel.org /pub/linux/kernel/v2.6/testing/ChangeLog-2.6.39-rc6
broken-link
permalink.gmane.org /gmane.linux.network/192898
mailing-list, broken-link
openwall.com /lists/oss-security/2011/04/22/2
mailing-list, third-party-advisory
openwall.com /lists/oss-security/2011/04/21/2
mailing-list, third-party-advisory
openwall.com /lists/oss-security/2011/04/20/6
mailing-list, third-party-advisory
openwall.com /lists/oss-security/2011/04/20/2
mailing-list, third-party-advisory
securityfocus.com /bid/47503
vdb-entry, third-party-advisory
bugzilla.redhat.com /show_bug.cgi?id=698057
issue-tracking, third-party-advisory

Sources

CVE List CVE-2011-1598
NVD CVE-2011-1598

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary