Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-1069
Vulnerability from certfr_avis - Published: 2026-08-21 - Updated: 2026-08-21
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian LTS. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Debian 12 bookworm versions ant\u00e9rieures \u00e0 6.12.101-1~deb12u1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-68116",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68116"
},
{
"name": "CVE-2026-68147",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68147"
},
{
"name": "CVE-2026-68343",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68343"
},
{
"name": "CVE-2026-68450",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68450"
},
{
"name": "CVE-2026-68271",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68271"
},
{
"name": "CVE-2026-64561",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64561"
},
{
"name": "CVE-2026-72051",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72051"
},
{
"name": "CVE-2026-68416",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68416"
},
{
"name": "CVE-2026-68193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68193"
},
{
"name": "CVE-2026-68388",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68388"
},
{
"name": "CVE-2026-68204",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68204"
},
{
"name": "CVE-2026-68302",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68302"
},
{
"name": "CVE-2026-68141",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68141"
},
{
"name": "CVE-2026-68225",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68225"
},
{
"name": "CVE-2026-53090",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53090"
},
{
"name": "CVE-2026-68339",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68339"
},
{
"name": "CVE-2026-68439",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68439"
},
{
"name": "CVE-2026-68218",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68218"
},
{
"name": "CVE-2026-68129",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68129"
},
{
"name": "CVE-2026-68245",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68245"
},
{
"name": "CVE-2026-68428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68428"
},
{
"name": "CVE-2026-68313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68313"
},
{
"name": "CVE-2026-72130",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72130"
},
{
"name": "CVE-2026-68317",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68317"
},
{
"name": "CVE-2026-68443",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68443"
},
{
"name": "CVE-2026-68326",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68326"
},
{
"name": "CVE-2026-68184",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68184"
},
{
"name": "CVE-2026-68228",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68228"
},
{
"name": "CVE-2026-72125",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72125"
},
{
"name": "CVE-2026-68417",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68417"
},
{
"name": "CVE-2026-68338",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68338"
},
{
"name": "CVE-2026-68248",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68248"
},
{
"name": "CVE-2026-68165",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68165"
},
{
"name": "CVE-2026-68277",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68277"
},
{
"name": "CVE-2026-72015",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72015"
},
{
"name": "CVE-2026-68410",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68410"
},
{
"name": "CVE-2026-68437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68437"
},
{
"name": "CVE-2026-68261",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68261"
},
{
"name": "CVE-2026-68128",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68128"
},
{
"name": "CVE-2026-68164",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68164"
},
{
"name": "CVE-2026-68304",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68304"
},
{
"name": "CVE-2026-68155",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68155"
},
{
"name": "CVE-2026-45901",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45901"
},
{
"name": "CVE-2026-64574",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64574"
},
{
"name": "CVE-2026-68294",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68294"
},
{
"name": "CVE-2026-68102",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68102"
},
{
"name": "CVE-2026-68385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68385"
},
{
"name": "CVE-2026-68446",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68446"
},
{
"name": "CVE-2026-68408",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68408"
},
{
"name": "CVE-2026-68226",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68226"
},
{
"name": "CVE-2026-68350",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68350"
},
{
"name": "CVE-2026-68419",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68419"
},
{
"name": "CVE-2026-68297",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68297"
},
{
"name": "CVE-2026-68199",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68199"
},
{
"name": "CVE-2026-68296",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68296"
},
{
"name": "CVE-2026-68425",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68425"
},
{
"name": "CVE-2026-68293",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68293"
},
{
"name": "CVE-2026-68365",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68365"
},
{
"name": "CVE-2026-72183",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72183"
},
{
"name": "CVE-2026-72254",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72254"
},
{
"name": "CVE-2026-68320",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68320"
},
{
"name": "CVE-2026-68176",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68176"
},
{
"name": "CVE-2026-68280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68280"
},
{
"name": "CVE-2026-68362",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68362"
},
{
"name": "CVE-2026-68430",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68430"
},
{
"name": "CVE-2026-68427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68427"
},
{
"name": "CVE-2026-68324",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68324"
},
{
"name": "CVE-2026-68308",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68308"
},
{
"name": "CVE-2026-68179",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68179"
},
{
"name": "CVE-2026-72260",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72260"
},
{
"name": "CVE-2026-68210",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68210"
},
{
"name": "CVE-2026-68120",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68120"
},
{
"name": "CVE-2026-72372",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72372"
},
{
"name": "CVE-2026-68309",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68309"
},
{
"name": "CVE-2026-68096",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68096"
},
{
"name": "CVE-2026-68403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68403"
},
{
"name": "CVE-2026-68139",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68139"
},
{
"name": "CVE-2026-68442",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68442"
},
{
"name": "CVE-2026-68093",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68093"
},
{
"name": "CVE-2026-64584",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64584"
},
{
"name": "CVE-2026-72299",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72299"
},
{
"name": "CVE-2026-68310",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68310"
},
{
"name": "CVE-2026-68115",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68115"
},
{
"name": "CVE-2026-68133",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68133"
},
{
"name": "CVE-2026-68221",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68221"
},
{
"name": "CVE-2026-68246",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68246"
},
{
"name": "CVE-2026-64563",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64563"
},
{
"name": "CVE-2026-68405",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68405"
},
{
"name": "CVE-2026-68219",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68219"
},
{
"name": "CVE-2026-68216",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68216"
},
{
"name": "CVE-2026-64580",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64580"
},
{
"name": "CVE-2026-68328",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68328"
},
{
"name": "CVE-2026-68394",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68394"
},
{
"name": "CVE-2026-68196",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68196"
},
{
"name": "CVE-2026-64280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64280"
},
{
"name": "CVE-2026-68269",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68269"
},
{
"name": "CVE-2026-68255",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68255"
},
{
"name": "CVE-2026-72017",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72017"
},
{
"name": "CVE-2026-68363",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68363"
},
{
"name": "CVE-2026-68213",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68213"
},
{
"name": "CVE-2026-68278",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68278"
},
{
"name": "CVE-2026-68145",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68145"
},
{
"name": "CVE-2026-72113",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72113"
},
{
"name": "CVE-2026-68361",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68361"
},
{
"name": "CVE-2026-68181",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68181"
},
{
"name": "CVE-2026-64570",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64570"
},
{
"name": "CVE-2026-68113",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68113"
},
{
"name": "CVE-2026-72213",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72213"
},
{
"name": "CVE-2026-68160",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68160"
},
{
"name": "CVE-2026-68100",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68100"
},
{
"name": "CVE-2026-68157",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68157"
},
{
"name": "CVE-2026-68368",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68368"
},
{
"name": "CVE-2026-68281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68281"
},
{
"name": "CVE-2026-68335",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68335"
},
{
"name": "CVE-2026-68329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68329"
},
{
"name": "CVE-2026-68189",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68189"
},
{
"name": "CVE-2026-68212",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68212"
},
{
"name": "CVE-2026-64568",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64568"
},
{
"name": "CVE-2026-72101",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72101"
},
{
"name": "CVE-2026-68119",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68119"
},
{
"name": "CVE-2026-68389",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68389"
},
{
"name": "CVE-2026-68314",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68314"
},
{
"name": "CVE-2026-68215",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68215"
},
{
"name": "CVE-2026-68099",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68099"
},
{
"name": "CVE-2026-68369",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68369"
},
{
"name": "CVE-2026-72253",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72253"
},
{
"name": "CVE-2026-68340",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68340"
},
{
"name": "CVE-2026-72137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72137"
},
{
"name": "CVE-2026-68352",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68352"
},
{
"name": "CVE-2026-68106",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68106"
},
{
"name": "CVE-2026-72103",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72103"
},
{
"name": "CVE-2026-68197",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68197"
},
{
"name": "CVE-2026-72040",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72040"
},
{
"name": "CVE-2026-68315",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68315"
},
{
"name": "CVE-2026-68346",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68346"
},
{
"name": "CVE-2026-68377",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68377"
},
{
"name": "CVE-2026-72114",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72114"
},
{
"name": "CVE-2026-68175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68175"
},
{
"name": "CVE-2026-68413",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68413"
},
{
"name": "CVE-2026-68372",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68372"
},
{
"name": "CVE-2026-68357",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68357"
},
{
"name": "CVE-2026-68376",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68376"
},
{
"name": "CVE-2026-64583",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64583"
},
{
"name": "CVE-2026-68262",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68262"
},
{
"name": "CVE-2026-68194",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68194"
},
{
"name": "CVE-2026-68127",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68127"
},
{
"name": "CVE-2026-68112",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68112"
},
{
"name": "CVE-2026-72142",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72142"
},
{
"name": "CVE-2026-72062",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72062"
},
{
"name": "CVE-2026-68146",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68146"
},
{
"name": "CVE-2026-68202",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68202"
},
{
"name": "CVE-2026-68104",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68104"
},
{
"name": "CVE-2026-72065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72065"
},
{
"name": "CVE-2026-68137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68137"
},
{
"name": "CVE-2026-68143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68143"
},
{
"name": "CVE-2026-68349",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68349"
},
{
"name": "CVE-2026-68257",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68257"
},
{
"name": "CVE-2026-68252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68252"
},
{
"name": "CVE-2026-72070",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72070"
},
{
"name": "CVE-2026-68351",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68351"
},
{
"name": "CVE-2026-68301",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68301"
},
{
"name": "CVE-2026-68402",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68402"
},
{
"name": "CVE-2026-68117",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68117"
},
{
"name": "CVE-2026-68333",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68333"
},
{
"name": "CVE-2026-68386",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68386"
},
{
"name": "CVE-2026-68111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68111"
},
{
"name": "CVE-2026-64577",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64577"
},
{
"name": "CVE-2026-68142",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68142"
},
{
"name": "CVE-2026-68243",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68243"
},
{
"name": "CVE-2026-68209",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68209"
},
{
"name": "CVE-2026-68306",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68306"
},
{
"name": "CVE-2026-68207",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68207"
},
{
"name": "CVE-2026-68373",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68373"
},
{
"name": "CVE-2026-68185",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68185"
},
{
"name": "CVE-2026-68206",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68206"
},
{
"name": "CVE-2026-68110",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68110"
},
{
"name": "CVE-2026-72117",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72117"
},
{
"name": "CVE-2026-68391",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68391"
},
{
"name": "CVE-2026-68227",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68227"
},
{
"name": "CVE-2026-68348",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68348"
},
{
"name": "CVE-2026-68331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68331"
},
{
"name": "CVE-2025-40098",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40098"
},
{
"name": "CVE-2026-72030",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72030"
},
{
"name": "CVE-2026-68432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68432"
},
{
"name": "CVE-2026-68319",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68319"
},
{
"name": "CVE-2026-68186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68186"
},
{
"name": "CVE-2026-68148",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68148"
},
{
"name": "CVE-2026-68344",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68344"
},
{
"name": "CVE-2026-45897",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45897"
},
{
"name": "CVE-2026-64578",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64578"
},
{
"name": "CVE-2026-68398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68398"
},
{
"name": "CVE-2026-68429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68429"
},
{
"name": "CVE-2026-68136",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68136"
},
{
"name": "CVE-2026-68395",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68395"
},
{
"name": "CVE-2026-68144",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68144"
},
{
"name": "CVE-2026-68263",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68263"
},
{
"name": "CVE-2026-68299",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68299"
},
{
"name": "CVE-2026-68366",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68366"
},
{
"name": "CVE-2026-68156",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68156"
},
{
"name": "CVE-2026-68187",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68187"
},
{
"name": "CVE-2026-68121",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68121"
},
{
"name": "CVE-2026-68231",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68231"
},
{
"name": "CVE-2026-68182",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68182"
},
{
"name": "CVE-2026-68422",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68422"
},
{
"name": "CVE-2026-68327",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68327"
},
{
"name": "CVE-2026-68358",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68358"
},
{
"name": "CVE-2026-68433",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68433"
},
{
"name": "CVE-2026-68190",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68190"
},
{
"name": "CVE-2026-68195",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68195"
},
{
"name": "CVE-2026-68318",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68318"
},
{
"name": "CVE-2026-68200",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68200"
},
{
"name": "CVE-2026-68279",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68279"
},
{
"name": "CVE-2026-68205",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68205"
},
{
"name": "CVE-2026-68234",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68234"
},
{
"name": "CVE-2026-68311",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68311"
},
{
"name": "CVE-2026-68321",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68321"
},
{
"name": "CVE-2026-68256",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68256"
},
{
"name": "CVE-2026-68140",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68140"
},
{
"name": "CVE-2026-68445",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68445"
},
{
"name": "CVE-2026-64562",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64562"
},
{
"name": "CVE-2026-72023",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72023"
},
{
"name": "CVE-2026-68434",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68434"
},
{
"name": "CVE-2026-68444",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68444"
},
{
"name": "CVE-2026-68153",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68153"
},
{
"name": "CVE-2026-64571",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64571"
},
{
"name": "CVE-2026-72168",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72168"
},
{
"name": "CVE-2026-68188",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68188"
},
{
"name": "CVE-2026-68161",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68161"
},
{
"name": "CVE-2026-68259",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68259"
},
{
"name": "CVE-2026-68235",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68235"
},
{
"name": "CVE-2026-68223",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68223"
},
{
"name": "CVE-2026-72116",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72116"
},
{
"name": "CVE-2026-72244",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72244"
},
{
"name": "CVE-2026-68414",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68414"
},
{
"name": "CVE-2026-68411",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68411"
},
{
"name": "CVE-2026-68131",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68131"
},
{
"name": "CVE-2026-68214",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68214"
},
{
"name": "CVE-2026-68217",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68217"
},
{
"name": "CVE-2026-68222",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68222"
},
{
"name": "CVE-2026-72045",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72045"
},
{
"name": "CVE-2026-68124",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68124"
},
{
"name": "CVE-2026-68381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68381"
},
{
"name": "CVE-2026-72305",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72305"
},
{
"name": "CVE-2026-68250",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68250"
},
{
"name": "CVE-2026-68371",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68371"
},
{
"name": "CVE-2026-68397",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68397"
},
{
"name": "CVE-2026-64572",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64572"
},
{
"name": "CVE-2026-68126",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68126"
},
{
"name": "CVE-2026-68396",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68396"
},
{
"name": "CVE-2026-72147",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72147"
},
{
"name": "CVE-2026-68449",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68449"
},
{
"name": "CVE-2026-68125",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68125"
},
{
"name": "CVE-2026-68135",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68135"
},
{
"name": "CVE-2026-72121",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72121"
},
{
"name": "CVE-2026-72032",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72032"
},
{
"name": "CVE-2026-68374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68374"
},
{
"name": "CVE-2026-68360",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68360"
},
{
"name": "CVE-2026-68244",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68244"
},
{
"name": "CVE-2026-64579",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64579"
},
{
"name": "CVE-2026-68249",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68249"
},
{
"name": "CVE-2026-68107",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68107"
},
{
"name": "CVE-2026-72146",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72146"
},
{
"name": "CVE-2026-72175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72175"
},
{
"name": "CVE-2026-68392",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68392"
},
{
"name": "CVE-2026-68300",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68300"
},
{
"name": "CVE-2026-68260",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68260"
},
{
"name": "CVE-2026-68229",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68229"
},
{
"name": "CVE-2026-68284",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68284"
},
{
"name": "CVE-2026-68152",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68152"
},
{
"name": "CVE-2026-68353",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68353"
},
{
"name": "CVE-2026-68108",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68108"
},
{
"name": "CVE-2026-64565",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64565"
},
{
"name": "CVE-2026-68158",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68158"
},
{
"name": "CVE-2026-64573",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64573"
},
{
"name": "CVE-2026-68325",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68325"
},
{
"name": "CVE-2026-68307",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68307"
},
{
"name": "CVE-2026-68355",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68355"
},
{
"name": "CVE-2026-68098",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68098"
},
{
"name": "CVE-2026-74436",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74436"
},
{
"name": "CVE-2026-68097",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68097"
},
{
"name": "CVE-2026-68180",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68180"
},
{
"name": "CVE-2026-68247",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68247"
},
{
"name": "CVE-2026-68407",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68407"
},
{
"name": "CVE-2026-68203",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68203"
},
{
"name": "CVE-2026-68123",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68123"
},
{
"name": "CVE-2026-53078",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53078"
},
{
"name": "CVE-2026-64205",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64205"
},
{
"name": "CVE-2026-68162",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68162"
},
{
"name": "CVE-2026-68220",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68220"
},
{
"name": "CVE-2026-68354",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68354"
},
{
"name": "CVE-2026-68149",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68149"
},
{
"name": "CVE-2026-68178",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68178"
},
{
"name": "CVE-2026-68183",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68183"
},
{
"name": "CVE-2026-68251",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68251"
},
{
"name": "CVE-2026-68151",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68151"
},
{
"name": "CVE-2026-72069",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72069"
},
{
"name": "CVE-2026-68359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68359"
},
{
"name": "CVE-2026-64290",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64290"
},
{
"name": "CVE-2026-68370",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68370"
},
{
"name": "CVE-2026-64567",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64567"
},
{
"name": "CVE-2026-68236",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68236"
},
{
"name": "CVE-2026-64576",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64576"
},
{
"name": "CVE-2026-68192",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68192"
},
{
"name": "CVE-2026-72124",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72124"
},
{
"name": "CVE-2026-68272",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68272"
},
{
"name": "CVE-2026-64564",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64564"
},
{
"name": "CVE-2026-72046",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72046"
},
{
"name": "CVE-2026-72119",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72119"
},
{
"name": "CVE-2026-68406",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68406"
},
{
"name": "CVE-2026-72115",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72115"
},
{
"name": "CVE-2026-68130",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68130"
},
{
"name": "CVE-2026-72118",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72118"
},
{
"name": "CVE-2026-68336",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68336"
},
{
"name": "CVE-2026-68201",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68201"
},
{
"name": "CVE-2026-64569",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64569"
},
{
"name": "CVE-2026-68290",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68290"
},
{
"name": "CVE-2026-68154",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68154"
}
],
"initial_release_date": "2026-08-21T00:00:00",
"last_revision_date": "2026-08-21T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1069",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-08-21T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian LTS. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian LTS",
"vendor_advisories": [
{
"published_at": "2026-08-18",
"title": "Bulletin de s\u00e9curit\u00e9 Debian LTS msg00035",
"url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00035.html"
}
]
}
CVE-2026-72113 (GCVE-0-2026-72113)
Vulnerability from cvelistv5 – Published: 2026-08-15 05:52 – Updated: 2026-08-19 16:35
VLAI
EPSS
VEX
Title
can: bcm: add missing device refcount for CAN filter removal
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: add missing device refcount for CAN filter removal
sashiko-bot remarked a problem with a concurrent device unregistration
in isotp.c which also is present in the bcm.c code. A former fix for raw.c
commit c275a176e4b6 ("can: raw: add missing refcount for memory leak fix")
introduced a netdevice_tracker which solves the issue for bcm.c too.
bcm_release(), bcm_delete_rx_op() and bcm_notifier() relied on
dev_get_by_index(ifindex) to re-find the device for an rx_op before
unregistering its filter. If a concurrent NETDEV_UNREGISTER has already
unlisted the device from the ifindex table, that lookup fails and
can_rx_unregister() is silently skipped, leaving a stale CAN filter
pointing at the soon-to-be-freed bcm_op/socket.
Hold a netdev_hold()/netdev_put() tracked reference on op->rx_reg_dev
from the moment the rx filter is registered in bcm_rx_setup() until it
is unregistered in bcm_rx_unreg(), and use that reference directly in
bcm_release() and bcm_delete_rx_op() instead of re-looking the device
up by ifindex.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ffd980f976e7fd666c2e61bf8ab35107efd11828 , < bd5232663524e94cc5aad861dca11e3db8e2ab6f
(git)
Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < ee8b36d0faca08f35b889b6e9aa850695e5b8ba9 (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < dcaee869913c7210cd47ed0a8f27349d7bdcdb7b (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 84aa4807816e405c1bf87114fc63e06d244281ef (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 633bda66fbf309f5de5e1ad6defe8e6b1d77a20f (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < b024c21c9066f6957b7d4a8f2037e4b000c5e041 (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 04d23061bbf18d5d81022eb21e9d32e99d24468d (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < d59948293ea34b6337ce2b5febab8510de70048c (git) |
|
| Linux | Linux |
Affected:
2.6.25
Unaffected: 0 , < 2.6.25 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/can/bcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bd5232663524e94cc5aad861dca11e3db8e2ab6f",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "ee8b36d0faca08f35b889b6e9aa850695e5b8ba9",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "dcaee869913c7210cd47ed0a8f27349d7bdcdb7b",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "84aa4807816e405c1bf87114fc63e06d244281ef",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "633bda66fbf309f5de5e1ad6defe8e6b1d77a20f",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "b024c21c9066f6957b7d4a8f2037e4b000c5e041",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "04d23061bbf18d5d81022eb21e9d32e99d24468d",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "d59948293ea34b6337ce2b5febab8510de70048c",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/can/bcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.25"
},
{
"lessThan": "2.6.25",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: add missing device refcount for CAN filter removal\n\nsashiko-bot remarked a problem with a concurrent device unregistration\nin isotp.c which also is present in the bcm.c code. A former fix for raw.c\ncommit c275a176e4b6 (\"can: raw: add missing refcount for memory leak fix\")\nintroduced a netdevice_tracker which solves the issue for bcm.c too.\n\nbcm_release(), bcm_delete_rx_op() and bcm_notifier() relied on\ndev_get_by_index(ifindex) to re-find the device for an rx_op before\nunregistering its filter. If a concurrent NETDEV_UNREGISTER has already\nunlisted the device from the ifindex table, that lookup fails and\ncan_rx_unregister() is silently skipped, leaving a stale CAN filter\npointing at the soon-to-be-freed bcm_op/socket.\n\nHold a netdev_hold()/netdev_put() tracked reference on op-\u003erx_reg_dev\nfrom the moment the rx filter is registered in bcm_rx_setup() until it\nis unregistered in bcm_rx_unreg(), and use that reference directly in\nbcm_release() and bcm_delete_rx_op() instead of re-looking the device\nup by ifindex."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local syscalls (socket/sendmsg/close) on PF_CAN/CAN_BCM and concurrent netdev teardown via netlink; the flaw is in local filter cleanup, not remote IP packet handling.\nAC:L - An attacker can reliably win the race by concurrently closing the BCM socket or issuing RX_DELETE while deleting the bound vcan/CAN interface from the same user namespace.\nPR:L - BCM sockets need no special capability, and CAP_NET_ADMIN for creating/deleting vcan interfaces is obtainable by unprivileged users via user namespaces (unshare -Urn).\nUI:N - No victim interaction is required; exploitation is fully attacker-driven through BCM socket setup, concurrent netdev removal, and subsequent CAN traffic to hit the stale filter.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same security authority; it does not cross VM, container, or IOMMU boundaries.\nC:H - Stale CAN filters leave a use-after-free on freed bcm_op structures; bcm_rx_handler dereferences attacker-influenced freed memory, enabling arbitrary kernel memory disclosure via heap grooming.\nI:H - The UAF in bcm_rx_handler provides write primitives over freed bcm_op fields (timers, frame buffers, socket pointers), enabling control-flow hijacking and arbitrary kernel code execution.\nA:H - Accessing the freed bcm_op from bcm_rx_handler causes kernel oops/panic; UAF is inherently crash-prone even before full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:35:58.404Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bd5232663524e94cc5aad861dca11e3db8e2ab6f"
},
{
"url": "https://git.kernel.org/stable/c/ee8b36d0faca08f35b889b6e9aa850695e5b8ba9"
},
{
"url": "https://git.kernel.org/stable/c/dcaee869913c7210cd47ed0a8f27349d7bdcdb7b"
},
{
"url": "https://git.kernel.org/stable/c/84aa4807816e405c1bf87114fc63e06d244281ef"
},
{
"url": "https://git.kernel.org/stable/c/633bda66fbf309f5de5e1ad6defe8e6b1d77a20f"
},
{
"url": "https://git.kernel.org/stable/c/b024c21c9066f6957b7d4a8f2037e4b000c5e041"
},
{
"url": "https://git.kernel.org/stable/c/04d23061bbf18d5d81022eb21e9d32e99d24468d"
},
{
"url": "https://git.kernel.org/stable/c/d59948293ea34b6337ce2b5febab8510de70048c"
}
],
"title": "can: bcm: add missing device refcount for CAN filter removal",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72113",
"datePublished": "2026-08-15T05:52:54.001Z",
"dateReserved": "2026-08-09T03:40:39.906Z",
"dateUpdated": "2026-08-19T16:35:58.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72114 (GCVE-0-2026-72114)
Vulnerability from cvelistv5 – Published: 2026-08-15 05:52 – Updated: 2026-08-19 16:36
VLAI
EPSS
VEX
Title
can: bcm: validate frame length in bcm_rx_setup() for RTR replies
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: validate frame length in bcm_rx_setup() for RTR replies
bcm_tx_setup() validates cf->len against the CAN/CAN FD DLC limits
before installing frames for TX_SETUP, but bcm_rx_setup() never did
the same for the RTR-reply frame configured via RX_SETUP with
RX_RTR_FRAME.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ffd980f976e7fd666c2e61bf8ab35107efd11828 , < cc1f9569f1c1adf74fa69d6f716a31b58a2fc6ce
(git)
Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 204f2b232717bc470ddb9e1da1d27dd9c6ef0caa (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < e061624c0a86c3c26a2bf017e432fbc93ad68f3a (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 7d966cdee006911d3957e1a4e72cb93c39cd8c1e (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 1b475c0c72f44622a320a4386ce9e76f85e69bc7 (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < deb6a697cce3f021e731df543597f37a5e54caab (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 59bfddea64159594feb62ef11b7d7a33c8ee3783 (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 62ec41f364648be79d54d94d0d240ee326948afd (git) |
|
| Linux | Linux |
Affected:
2.6.25
Unaffected: 0 , < 2.6.25 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/can/bcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cc1f9569f1c1adf74fa69d6f716a31b58a2fc6ce",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "204f2b232717bc470ddb9e1da1d27dd9c6ef0caa",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "e061624c0a86c3c26a2bf017e432fbc93ad68f3a",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "7d966cdee006911d3957e1a4e72cb93c39cd8c1e",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "1b475c0c72f44622a320a4386ce9e76f85e69bc7",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "deb6a697cce3f021e731df543597f37a5e54caab",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "59bfddea64159594feb62ef11b7d7a33c8ee3783",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "62ec41f364648be79d54d94d0d240ee326948afd",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/can/bcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.25"
},
{
"lessThan": "2.6.25",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: validate frame length in bcm_rx_setup() for RTR replies\n\nbcm_tx_setup() validates cf-\u003elen against the CAN/CAN FD DLC limits\nbefore installing frames for TX_SETUP, but bcm_rx_setup() never did\nthe same for the RTR-reply frame configured via RX_SETUP with\nRX_RTR_FRAME."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The missing validation is in bcm_rx_setup(), reached only via local PF_CAN SOCK_DGRAM CAN_BCM syscalls (socket/connect/sendmsg RX_SETUP with RX_RTR_FRAME); it is not triggered by remote IP services or by CAN bus traffic alone.\nAC:L - An attacker reliably installs a malformed RTR-reply frame with a single RX_SETUP sendmsg and can trigger bcm_can_tx() by sending or waiting for a matching RTR on the bound interface, with no races or layout dependencies beyond their control.\nPR:L - can_create(), bcm_connect(), and bcm_sendmsg() perform no capability checks; any local user with access to a CAN interface (including vcan created with CAP_NET_ADMIN in an unprivileged user namespace) can open BCM sockets and program RX_SETUP RTR replies.\nUI:N - Exploitation requires only the attacker opening a BCM socket and sending RX_SETUP messages; no victim interaction such as mounting filesystems or opening files is needed once local CAN access exists.\nS:U - Impact is kernel memory corruption and unauthorized CAN frame transmission within the same host security domain; it does not cross VM, container, or IOMMU boundaries even when frames reach an adjacent vehicle or industrial CAN segment.\nC:H - Unvalidated cf-\u003elen values are stored in op-\u003eframes and later passed to bcm_can_tx()/can_send(); many CAN driver ndo_start_xmit paths memcpy(cf-\u003edata, cf-\u003elen) trusting len, enabling out-of-bounds kernel reads when invalid lengths bypass or race skb validation.\nI:H - Attacker-controlled len in the RTR-reply frame can drive out-of-bounds memcpy writes in CAN USB/SPI/hardware xmit paths and inject attacker-crafted frame payloads onto safety-critical automotive, factory, or embedded CAN buses when RTR requests are answered.\nA:H - Out-of-bounds accesses in CAN driver transmit paths from trusted-but-invalid len values can cause kernel WARN/Oops/panic on hardened builds, and repeated malformed RTR-reply transmission attempts can wedge TX queues or disrupt CAN service on affected systems."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:36:00.857Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cc1f9569f1c1adf74fa69d6f716a31b58a2fc6ce"
},
{
"url": "https://git.kernel.org/stable/c/204f2b232717bc470ddb9e1da1d27dd9c6ef0caa"
},
{
"url": "https://git.kernel.org/stable/c/e061624c0a86c3c26a2bf017e432fbc93ad68f3a"
},
{
"url": "https://git.kernel.org/stable/c/7d966cdee006911d3957e1a4e72cb93c39cd8c1e"
},
{
"url": "https://git.kernel.org/stable/c/1b475c0c72f44622a320a4386ce9e76f85e69bc7"
},
{
"url": "https://git.kernel.org/stable/c/deb6a697cce3f021e731df543597f37a5e54caab"
},
{
"url": "https://git.kernel.org/stable/c/59bfddea64159594feb62ef11b7d7a33c8ee3783"
},
{
"url": "https://git.kernel.org/stable/c/62ec41f364648be79d54d94d0d240ee326948afd"
}
],
"title": "can: bcm: validate frame length in bcm_rx_setup() for RTR replies",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72114",
"datePublished": "2026-08-15T05:52:54.750Z",
"dateReserved": "2026-08-09T03:40:39.906Z",
"dateUpdated": "2026-08-19T16:36:00.857Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72115 (GCVE-0-2026-72115)
Vulnerability from cvelistv5 – Published: 2026-08-15 05:52 – Updated: 2026-08-19 16:36
VLAI
EPSS
VEX
Title
can: bcm: track a single source interface for ANYDEV timeout/throttle ops
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: track a single source interface for ANYDEV timeout/throttle ops
An ANYDEV rx op (ifindex == 0) with an active RX timeout and/or
throttle timer has no defined semantics when matching frames arrive
from several interfaces: bcm_rx_handler() can run concurrently for
the same op on different CPUs, racing hrtimer_cancel()/
bcm_rx_starttimer() against bcm_rx_timeout_handler() and causing
spurious RX_TIMEOUT notifications and last_frames corruption. The
same concurrency lets throttled multiplex frames from different
interfaces clobber the single rx_ifindex/rx_stamp fields shared by
the op.
Add op->if_detected to track the first interface that delivers a
matching frame while a timeout/throttle timer is configured, and
reject frames from any other interface for that op. The claim is
decided in bcm_rx_handler() before hrtimer_cancel() touches
op->timer, so a rejected frame can never disturb the claimed
interface's watchdog. RTR-mode ops are excluded via RX_RTR_FRAME,
independent of kt_ival1/kt_ival2, since those may briefly hold a
stale value from an earlier non-RTR configuration.
The claim is released in bcm_notify() on NETDEV_UNREGISTER and in
bcm_rx_setup() when SETTIMER reconfigures the timer values.
A (re-)claim is only possible on CAN devices in NETREG_REGISTERED
dev->reg_state to cover the release in bcm_notify() where reg_state
becomes NETREG_UNREGISTERING until synchronize_net().
Severity
8.1 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ffd980f976e7fd666c2e61bf8ab35107efd11828 , < f147f48837cb1426521f5b3c3b3134c71128a25d
(git)
Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 57cf104da4cf450ae9c16801a3164604b801d2cc (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 03dfe347c398fa41a7e30e8dc538f12568c183e6 (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 18b45251e74e35668f0dd0c470549384ae191ecf (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 3ff8c24b421070a2db99a5cdb86edc9ff339418e (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < eca8b44d51fc6ab61022258ec968e55e3073b79e (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < b6317022b685a430a3ae420456716e3c0c02ef4b (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 2f5976f54a04e9f18b25283036ac3136be453b17 (git) |
|
| Linux | Linux |
Affected:
2.6.25
Unaffected: 0 , < 2.6.25 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/can/bcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f147f48837cb1426521f5b3c3b3134c71128a25d",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "57cf104da4cf450ae9c16801a3164604b801d2cc",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "03dfe347c398fa41a7e30e8dc538f12568c183e6",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "18b45251e74e35668f0dd0c470549384ae191ecf",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "3ff8c24b421070a2db99a5cdb86edc9ff339418e",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "eca8b44d51fc6ab61022258ec968e55e3073b79e",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "b6317022b685a430a3ae420456716e3c0c02ef4b",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "2f5976f54a04e9f18b25283036ac3136be453b17",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/can/bcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.25"
},
{
"lessThan": "2.6.25",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: track a single source interface for ANYDEV timeout/throttle ops\n\nAn ANYDEV rx op (ifindex == 0) with an active RX timeout and/or\nthrottle timer has no defined semantics when matching frames arrive\nfrom several interfaces: bcm_rx_handler() can run concurrently for\nthe same op on different CPUs, racing hrtimer_cancel()/\nbcm_rx_starttimer() against bcm_rx_timeout_handler() and causing\nspurious RX_TIMEOUT notifications and last_frames corruption. The\nsame concurrency lets throttled multiplex frames from different\ninterfaces clobber the single rx_ifindex/rx_stamp fields shared by\nthe op.\n\nAdd op-\u003eif_detected to track the first interface that delivers a\nmatching frame while a timeout/throttle timer is configured, and\nreject frames from any other interface for that op. The claim is\ndecided in bcm_rx_handler() before hrtimer_cancel() touches\nop-\u003etimer, so a rejected frame can never disturb the claimed\ninterface\u0027s watchdog. RTR-mode ops are excluded via RX_RTR_FRAME,\nindependent of kt_ival1/kt_ival2, since those may briefly hold a\nstale value from an earlier non-RTR configuration.\n\nThe claim is released in bcm_notify() on NETDEV_UNREGISTER and in\nbcm_rx_setup() when SETTIMER reconfigures the timer values.\n\nA (re-)claim is only possible on CAN devices in NETREG_REGISTERED\ndev-\u003ereg_state to cover the release in bcm_notify() where reg_state\nbecomes NETREG_UNREGISTERING until synchronize_net()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - bcm_rx_handler() is reached from the CAN driver RX path when matching frames arrive on multiple interfaces; on automotive/industrial systems an attacker on shared CAN segment(s) can inject concurrent frames without host shell access once an ANYDEV BCM RX op with active timeout/throttle timers exists.\nAC:L - The attacker controls both sides of the race by flooding matching frames on multiple CAN interfaces (or paired vcan devices) to run bcm_rx_handler() concurrently on different CPUs, racing hrtimer_cancel/bcm_rx_starttimer against bcm_rx_timeout_handler and interleaved last_frames writers.\nPR:N - No Linux capability or account is required to deliver triggering CAN traffic on multiple interfaces; bcm_rx_handler() runs from the unauthenticated netdev RX path once any ANYDEV BCM RX op with active kt_ival1/kt_ival2 timers exists, as commonly configured by telematics/diagnostic daemons.\nUI:N - Exploitation requires no victim interaction beyond normal system operation; malicious or concurrent CAN frames are processed automatically in softirq without mounts, file opens, or user prompts.\nS:U - Impact is confined to corrupted BCM state and incorrect CAN notifications delivered to the subscribing userspace process within the same kernel/host security boundary; no VM, container, or IOMMU escape is involved.\nC:H - Concurrent bcm_rx_handler() and bcm_rx_timeout_handler() races corrupt op-\u003elast_frames heap buffers via unsynchronized memcpy/memset, mixing attacker-controlled CAN payloads from different interfaces and leaking cross-bus frame content through bcm_send_to_user().\nI:H - last_frames corruption lets attacker-controlled frames from one interface overwrite or interleave with another\u0027s stored/throttled state, misattributing RX_CHANGED/RX_TIMEOUT notifications and corrupting safety- or security-relevant CAN monitoring and control decisions.\nA:N - The race corrupts per-op BCM buffers and emits spurious RX_TIMEOUT events but does not dereference freed objects, overrun buffer bounds, or fault the kernel; no oops, panic, hang, or sustained kernel denial of service is indicated."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:36:03.316Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f147f48837cb1426521f5b3c3b3134c71128a25d"
},
{
"url": "https://git.kernel.org/stable/c/57cf104da4cf450ae9c16801a3164604b801d2cc"
},
{
"url": "https://git.kernel.org/stable/c/03dfe347c398fa41a7e30e8dc538f12568c183e6"
},
{
"url": "https://git.kernel.org/stable/c/18b45251e74e35668f0dd0c470549384ae191ecf"
},
{
"url": "https://git.kernel.org/stable/c/3ff8c24b421070a2db99a5cdb86edc9ff339418e"
},
{
"url": "https://git.kernel.org/stable/c/eca8b44d51fc6ab61022258ec968e55e3073b79e"
},
{
"url": "https://git.kernel.org/stable/c/b6317022b685a430a3ae420456716e3c0c02ef4b"
},
{
"url": "https://git.kernel.org/stable/c/2f5976f54a04e9f18b25283036ac3136be453b17"
}
],
"title": "can: bcm: track a single source interface for ANYDEV timeout/throttle ops",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72115",
"datePublished": "2026-08-15T05:52:55.524Z",
"dateReserved": "2026-08-09T03:40:39.906Z",
"dateUpdated": "2026-08-19T16:36:03.316Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72116 (GCVE-0-2026-72116)
Vulnerability from cvelistv5 – Published: 2026-08-15 05:52 – Updated: 2026-08-19 16:36
VLAI
EPSS
VEX
Title
can: bcm: fix stale rx/tx ops after device removal
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: fix stale rx/tx ops after device removal
RX: an RX_SETUP update(!) for an existing op skipped can_rx_register()
unconditionally, even when a concurrent NETDEV_UNREGISTER had already
torn down its registration (op->rx_reg_dev == NULL). This silently
did not re-enable frame delivery for that updated filter. bcm_rx_setup()
now re-registers in that case, while leaving rx_ops with ifindex = 0
(all CAN devices) which never carry a tracked rx_reg_dev registered as-is.
TX: bcm_notify() only handled bo->rx_ops on NETDEV_UNREGISTER, leaving
tx_ops with an active cyclic transmission re-arming its hrtimer
indefinitely to execute bcm_tx_timeout_handler(). Cancelling the hrtimer
prevents the runaway timer and any injection into a later reused ifindex,
since nothing else calls bcm_can_tx() for the op until an explicit
TX_SETUP update re-arms it.
Unlike bcm_rx_unreg(), which clears the tracked rx_reg_dev for rx_ops,
the ifindex is intentionally left unchanged for tx_ops. bcm_tx_setup()
always rejects ifindex 0, so clearing it would strand the op: neither a
later TX_SETUP (bcm_find_op()) nor TX_DELETE (bcm_delete_tx_op()) could
ever find it again, since both require an exact ifindex match.
Severity
7.1 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ffd980f976e7fd666c2e61bf8ab35107efd11828 , < d30a36066ed3abefb72ae18901f71841ba18b350
(git)
Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < ca829677ffa2de5d79e06366e19ac1e4f5cc78dd (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 9517d8fb0b191398d35b9b7f8c719c1cc7761cb1 (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 60d8a7942f4ed2d975207aaeba1adb576707e53d (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < f749e4564952d60e96930c09f2be99955d07c22e (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 6be3e1fedf03eab36a2c09d755d1171287b2014b (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < b31d0933509c5a35c0be5736a2ce8df0d1bf112c (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 3b762c0d950383ab7a002686c9136b9aa55d2d70 (git) |
|
| Linux | Linux |
Affected:
2.6.25
Unaffected: 0 , < 2.6.25 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/can/bcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d30a36066ed3abefb72ae18901f71841ba18b350",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "ca829677ffa2de5d79e06366e19ac1e4f5cc78dd",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "9517d8fb0b191398d35b9b7f8c719c1cc7761cb1",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "60d8a7942f4ed2d975207aaeba1adb576707e53d",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "f749e4564952d60e96930c09f2be99955d07c22e",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "6be3e1fedf03eab36a2c09d755d1171287b2014b",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "b31d0933509c5a35c0be5736a2ce8df0d1bf112c",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "3b762c0d950383ab7a002686c9136b9aa55d2d70",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/can/bcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.25"
},
{
"lessThan": "2.6.25",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: fix stale rx/tx ops after device removal\n\nRX: an RX_SETUP update(!) for an existing op skipped can_rx_register()\nunconditionally, even when a concurrent NETDEV_UNREGISTER had already\ntorn down its registration (op-\u003erx_reg_dev == NULL). This silently\ndid not re-enable frame delivery for that updated filter. bcm_rx_setup()\nnow re-registers in that case, while leaving rx_ops with ifindex = 0\n(all CAN devices) which never carry a tracked rx_reg_dev registered as-is.\n\nTX: bcm_notify() only handled bo-\u003erx_ops on NETDEV_UNREGISTER, leaving\ntx_ops with an active cyclic transmission re-arming its hrtimer\nindefinitely to execute bcm_tx_timeout_handler(). Cancelling the hrtimer\nprevents the runaway timer and any injection into a later reused ifindex,\nsince nothing else calls bcm_can_tx() for the op until an explicit\nTX_SETUP update re-arms it.\n\nUnlike bcm_rx_unreg(), which clears the tracked rx_reg_dev for rx_ops,\nthe ifindex is intentionally left unchanged for tx_ops. bcm_tx_setup()\nalways rejects ifindex 0, so clearing it would strand the op: neither a\nlater TX_SETUP (bcm_find_op()) nor TX_DELETE (bcm_delete_tx_op()) could\never find it again, since both require an exact ifindex match."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only via local PF_CAN/CAN_BCM syscalls (socket/connect/sendmsg TX_SETUP or RX_SETUP); bcm_tx_timeout_handler() is driven by a local hrtimer, not by remote network services or CAN bus frames alone.\nAC:L - An attacker controls both sides by arming cyclic TX with SETTIMER/STARTTIMER, then triggering or waiting for NETDEV_UNREGISTER (e.g., concurrent ip link del in a user namespace) while ifindex reuse is normal kernel behavior, making injection reliably achievable.\nPR:L - can_create(), bcm_connect(), and bcm_sendmsg() perform no capability checks; any local user with CAN access (or CAP_NET_ADMIN in an unprivileged user namespace to create vcan) can open BCM sockets and program cyclic TX/RX ops.\nUI:N - Exploitation requires only the attacker opening a BCM socket and sending TX_SETUP/RX_SETUP messages; no victim action such as mounting media or opening files is needed once local CAN access exists.\nS:U - Impact is unauthorized CAN transmission/monitoring disruption within the same kernel host; it does not cross VM, container, or IOMMU security boundaries even when frames reach an adjacent vehicle or factory CAN segment.\nC:N - The flaw causes stale timer-driven transmission and missed RX re-registration, not kernel memory disclosure; no out-of-bounds read, UAF, or other information-leak primitive is present in this bug.\nI:H - After NETDEV_UNREGISTER, orphaned tx_ops keep bcm_can_tx() running with a stale ifindex, so attacker-crafted cyclic CAN frames can be injected onto any later netdev that reuses that ifindex, including safety-critical automotive or industrial buses.\nA:H - Uncancelled hrtimers on stale tx_ops re-arm bcm_tx_timeout_handler() indefinitely after device removal, causing persistent timer/softirq CPU consumption, and the RX_SETUP path can silently stop frame delivery after unregister races."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:36:05.976Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d30a36066ed3abefb72ae18901f71841ba18b350"
},
{
"url": "https://git.kernel.org/stable/c/ca829677ffa2de5d79e06366e19ac1e4f5cc78dd"
},
{
"url": "https://git.kernel.org/stable/c/9517d8fb0b191398d35b9b7f8c719c1cc7761cb1"
},
{
"url": "https://git.kernel.org/stable/c/60d8a7942f4ed2d975207aaeba1adb576707e53d"
},
{
"url": "https://git.kernel.org/stable/c/f749e4564952d60e96930c09f2be99955d07c22e"
},
{
"url": "https://git.kernel.org/stable/c/6be3e1fedf03eab36a2c09d755d1171287b2014b"
},
{
"url": "https://git.kernel.org/stable/c/b31d0933509c5a35c0be5736a2ce8df0d1bf112c"
},
{
"url": "https://git.kernel.org/stable/c/3b762c0d950383ab7a002686c9136b9aa55d2d70"
}
],
"title": "can: bcm: fix stale rx/tx ops after device removal",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72116",
"datePublished": "2026-08-15T05:52:56.260Z",
"dateReserved": "2026-08-09T03:40:39.906Z",
"dateUpdated": "2026-08-19T16:36:05.976Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72117 (GCVE-0-2026-72117)
Vulnerability from cvelistv5 – Published: 2026-08-15 05:52 – Updated: 2026-08-19 16:36
VLAI
EPSS
VEX
Title
can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
For an rx op subscribed on all interfaces (ifindex == 0), the same op
is registered once in the shared per-netns wildcard filter list, so
bcm_rx_handler() can run concurrently on different CPUs for frames
arriving on different net devices.
op->rx_stamp and op->rx_ifindex were written before bcm_rx_update_lock was
taken, allowing concurrent writers to race each other - including a torn
store of the 64-bit rx_stamp on 32-bit platforms.
Beyond a torn store bcm_send_to_user() must report the timestamp/ifindex
of the very same frame whose content it is delivering. So the assignment
is placed in the same unbroken bcm_rx_update_lock section as the content
comparison.
As a side effect, the RTR-request frame feature (which never reach
bcm_send_to_user()) no longer updates rx_stamp/rx_ifindex, since only
the notification path needs them.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ffd980f976e7fd666c2e61bf8ab35107efd11828 , < b64f60c468d149aca22ea56bb842b9730215aaa5
(git)
Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < c8a5d7cb095d3b12bd9dcf752d6ca0ff50872ac5 (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 4b97410f4bba18d2ee2784c8e089104f387bc27c (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 5f246b96ab47523ec9b8ea870b5c567a3cb1eb1c (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 656ff69ef235699035e57d9e1ae417e62a38aa7f (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 136de17f38630307991c59aa7080012a99451783 (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < c312b750bb5ac3348cfc85dab25e90937bd4d251 (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 58fd6cbc8541216af1d7ed272ea7ac2b66d50fd8 (git) |
|
| Linux | Linux |
Affected:
2.6.25
Unaffected: 0 , < 2.6.25 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/can/bcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b64f60c468d149aca22ea56bb842b9730215aaa5",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "c8a5d7cb095d3b12bd9dcf752d6ca0ff50872ac5",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "4b97410f4bba18d2ee2784c8e089104f387bc27c",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "5f246b96ab47523ec9b8ea870b5c567a3cb1eb1c",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "656ff69ef235699035e57d9e1ae417e62a38aa7f",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "136de17f38630307991c59aa7080012a99451783",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "c312b750bb5ac3348cfc85dab25e90937bd4d251",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "58fd6cbc8541216af1d7ed272ea7ac2b66d50fd8",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/can/bcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.25"
},
{
"lessThan": "2.6.25",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()\n\nFor an rx op subscribed on all interfaces (ifindex == 0), the same op\nis registered once in the shared per-netns wildcard filter list, so\nbcm_rx_handler() can run concurrently on different CPUs for frames\narriving on different net devices.\n\nop-\u003erx_stamp and op-\u003erx_ifindex were written before bcm_rx_update_lock was\ntaken, allowing concurrent writers to race each other - including a torn\nstore of the 64-bit rx_stamp on 32-bit platforms.\n\nBeyond a torn store bcm_send_to_user() must report the timestamp/ifindex\nof the very same frame whose content it is delivering. So the assignment\nis placed in the same unbroken bcm_rx_update_lock section as the content\ncomparison.\n\nAs a side effect, the RTR-request frame feature (which never reach\nbcm_send_to_user()) no longer updates rx_stamp/rx_ifindex, since only\nthe notification path needs them."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:36:08.847Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b64f60c468d149aca22ea56bb842b9730215aaa5"
},
{
"url": "https://git.kernel.org/stable/c/c8a5d7cb095d3b12bd9dcf752d6ca0ff50872ac5"
},
{
"url": "https://git.kernel.org/stable/c/4b97410f4bba18d2ee2784c8e089104f387bc27c"
},
{
"url": "https://git.kernel.org/stable/c/5f246b96ab47523ec9b8ea870b5c567a3cb1eb1c"
},
{
"url": "https://git.kernel.org/stable/c/656ff69ef235699035e57d9e1ae417e62a38aa7f"
},
{
"url": "https://git.kernel.org/stable/c/136de17f38630307991c59aa7080012a99451783"
},
{
"url": "https://git.kernel.org/stable/c/c312b750bb5ac3348cfc85dab25e90937bd4d251"
},
{
"url": "https://git.kernel.org/stable/c/58fd6cbc8541216af1d7ed272ea7ac2b66d50fd8"
}
],
"title": "can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72117",
"datePublished": "2026-08-15T05:52:56.991Z",
"dateReserved": "2026-08-09T03:40:39.906Z",
"dateUpdated": "2026-08-19T16:36:08.847Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72118 (GCVE-0-2026-72118)
Vulnerability from cvelistv5 – Published: 2026-08-15 05:52 – Updated: 2026-08-19 16:36
VLAI
EPSS
VEX
Title
can: bcm: fix CAN frame rx/tx statistics
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: fix CAN frame rx/tx statistics
KCSAN detected a data race within the bcm_rx_handler() when two CAN frames
have been simultaneously received and processed in a single rx op by two
different CPUs.
Use atomic operations with (signed) long data types to access the
statistics in the hot path to fix the KCSAN complaint.
Additionally simplify the update and check of statistics overflow by
using the atomic operations in separate bcm_update_[rx|tx]_stats()
functions. The rx variant runs under bcm_rx_update_lock to prevent
races when resetting the two rx counters; the tx variant runs under
bcm_tx_lock and only needs to guard its own counter's overflow.
As the rx path resets its values already at LONG_MAX / 100, there is
no conflict between the two locking domains (bcm_rx_update_lock vs.
bcm_tx_lock) even for ops that use both paths.
The rx statistics update and the frames_filtered update in
bcm_rx_changed() were previously performed in two separate
bcm_rx_update_lock sections. For an rx op subscribed on all interfaces
(ifindex == 0), bcm_rx_handler() can run concurrently on different
CPUs, so a counter reset by one CPU between these two sections could
leave frames_filtered larger than frames_abs on another CPU, producing
a bogus (even negative) reduction percentage in procfs. Update the
statistics in the same critical section as bcm_rx_changed() to close
this gap, which also removes the now unneeded extra lock/unlock pair
around the traffic_flags calculation.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 640acf3566fc897065127001be875ebc5401c218
(git)
Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 47fca0d1620f2d4fab0677564989ef2b9c225c66 (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < fd75884eae40a7be47867cbfc9fc84a80bb8ddb4 (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 8b2783172d92edd650de6006ebd1c800937021ab (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 970caff5c1a63702c80e08d920256bcb5f88ecc5 (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < 8104bcdb2612fdda95169ddc3b49747b2ff98d24 (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < df47f07cdc801a6afe05a486b5a343c3e532a93c (git) Affected: ffd980f976e7fd666c2e61bf8ab35107efd11828 , < e6c24ba95fc3f1b5e1dcd28b1c6e59ef61a9daa5 (git) |
|
| Linux | Linux |
Affected:
2.6.25
Unaffected: 0 , < 2.6.25 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/can/bcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "640acf3566fc897065127001be875ebc5401c218",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "47fca0d1620f2d4fab0677564989ef2b9c225c66",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "fd75884eae40a7be47867cbfc9fc84a80bb8ddb4",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "8b2783172d92edd650de6006ebd1c800937021ab",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "970caff5c1a63702c80e08d920256bcb5f88ecc5",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "8104bcdb2612fdda95169ddc3b49747b2ff98d24",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "df47f07cdc801a6afe05a486b5a343c3e532a93c",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
},
{
"lessThan": "e6c24ba95fc3f1b5e1dcd28b1c6e59ef61a9daa5",
"status": "affected",
"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/can/bcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.25"
},
{
"lessThan": "2.6.25",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: fix CAN frame rx/tx statistics\n\nKCSAN detected a data race within the bcm_rx_handler() when two CAN frames\nhave been simultaneously received and processed in a single rx op by two\ndifferent CPUs.\n\nUse atomic operations with (signed) long data types to access the\nstatistics in the hot path to fix the KCSAN complaint.\n\nAdditionally simplify the update and check of statistics overflow by\nusing the atomic operations in separate bcm_update_[rx|tx]_stats()\nfunctions. The rx variant runs under bcm_rx_update_lock to prevent\nraces when resetting the two rx counters; the tx variant runs under\nbcm_tx_lock and only needs to guard its own counter\u0027s overflow.\n\nAs the rx path resets its values already at LONG_MAX / 100, there is\nno conflict between the two locking domains (bcm_rx_update_lock vs.\nbcm_tx_lock) even for ops that use both paths.\n\nThe rx statistics update and the frames_filtered update in\nbcm_rx_changed() were previously performed in two separate\nbcm_rx_update_lock sections. For an rx op subscribed on all interfaces\n(ifindex == 0), bcm_rx_handler() can run concurrently on different\nCPUs, so a counter reset by one CPU between these two sections could\nleave frames_filtered larger than frames_abs on another CPU, producing\na bogus (even negative) reduction percentage in procfs. Update the\nstatistics in the same critical section as bcm_rx_changed() to close\nthis gap, which also removes the now unneeded extra lock/unlock pair\naround the traffic_flags calculation."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:36:11.603Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/640acf3566fc897065127001be875ebc5401c218"
},
{
"url": "https://git.kernel.org/stable/c/47fca0d1620f2d4fab0677564989ef2b9c225c66"
},
{
"url": "https://git.kernel.org/stable/c/fd75884eae40a7be47867cbfc9fc84a80bb8ddb4"
},
{
"url": "https://git.kernel.org/stable/c/8b2783172d92edd650de6006ebd1c800937021ab"
},
{
"url": "https://git.kernel.org/stable/c/970caff5c1a63702c80e08d920256bcb5f88ecc5"
},
{
"url": "https://git.kernel.org/stable/c/8104bcdb2612fdda95169ddc3b49747b2ff98d24"
},
{
"url": "https://git.kernel.org/stable/c/df47f07cdc801a6afe05a486b5a343c3e532a93c"
},
{
"url": "https://git.kernel.org/stable/c/e6c24ba95fc3f1b5e1dcd28b1c6e59ef61a9daa5"
}
],
"title": "can: bcm: fix CAN frame rx/tx statistics",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72118",
"datePublished": "2026-08-15T05:52:57.734Z",
"dateReserved": "2026-08-09T03:40:39.906Z",
"dateUpdated": "2026-08-19T16:36:11.603Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72119 (GCVE-0-2026-72119)
Vulnerability from cvelistv5 – Published: 2026-08-15 05:52 – Updated: 2026-08-19 16:36
VLAI
EPSS
VEX
Title
can: bcm: extend bcm_tx_lock usage for data and timer updates
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: extend bcm_tx_lock usage for data and timer updates
Stage new CAN frame content for an existing tx op into a kmalloc()'d
buffer and validate it there, mirroring the approach already used in
bcm_rx_setup(). Only copy the validated data into op->frames while
holding op->bcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler()
can no longer observe a partially updated or unvalidated frame.
Add a missing error path for memcpy_from_msg() when copying CAN frame
data from userspace.
Also move the kt_ival1/kt_ival2/ival1/ival2 updates in bcm_tx_setup()
under op->bcm_tx_lock, and read kt_ival1/kt_ival2/count under the same
lock in bcm_tx_set_expiry() and bcm_tx_timeout_handler(), closing the
torn 64-bit ktime_t read on 32-bit platforms.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7595de7bc56e0e52b74e56c90f7e247bf626d628 , < a538b072ee074c9b41b9d9c15a6861a963e30755
(git)
Affected: fbd8fdc2b218e979cfe422b139b8f74c12419d1f , < 63422347b4c782f429748b2a09cd3cf3b77e6abd (git) Affected: 2a437b86ac5a9893c902f30ef66815bf13587bf6 , < 37917e432e50b7de2b64230974380132a30f7270 (git) Affected: 76c84c3728178b2d38d5604e399dfe8b0752645e , < 52f06e7603780de100233713ddaf971d422e10ef (git) Affected: cc55dd28c20a6611e30596019b3b2f636819a4c0 , < 972fd66bb08fdef1090abe43196ca8da07216d13 (git) Affected: c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 , < bd46f55dec608daa44b45dcf3328517630ad8e40 (git) Affected: c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 , < 337f966c00662d81ad82cf5a4bbb150b2e32c0d4 (git) Affected: c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 , < 12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc (git) Affected: 8f1c022541bf5a923c8d6fa483112c15250f30a4 (git) Affected: c4e8a172501e677ebd8ea9d9161d97dc4df56fbd (git) Affected: 5.10.238 , < 5.10.265 (semver) Affected: 5.15.185 , < 5.15.216 (semver) Affected: 6.1.141 , < 6.1.183 (semver) Affected: 6.6.93 , < 6.6.148 (semver) Affected: 6.12.31 , < 6.12.101 (semver) Affected: 5.4.294 , < 5.5 (semver) Affected: 6.14.9 , < 6.15 (semver) |
|
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/can/bcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a538b072ee074c9b41b9d9c15a6861a963e30755",
"status": "affected",
"version": "7595de7bc56e0e52b74e56c90f7e247bf626d628",
"versionType": "git"
},
{
"lessThan": "63422347b4c782f429748b2a09cd3cf3b77e6abd",
"status": "affected",
"version": "fbd8fdc2b218e979cfe422b139b8f74c12419d1f",
"versionType": "git"
},
{
"lessThan": "37917e432e50b7de2b64230974380132a30f7270",
"status": "affected",
"version": "2a437b86ac5a9893c902f30ef66815bf13587bf6",
"versionType": "git"
},
{
"lessThan": "52f06e7603780de100233713ddaf971d422e10ef",
"status": "affected",
"version": "76c84c3728178b2d38d5604e399dfe8b0752645e",
"versionType": "git"
},
{
"lessThan": "972fd66bb08fdef1090abe43196ca8da07216d13",
"status": "affected",
"version": "cc55dd28c20a6611e30596019b3b2f636819a4c0",
"versionType": "git"
},
{
"lessThan": "bd46f55dec608daa44b45dcf3328517630ad8e40",
"status": "affected",
"version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7",
"versionType": "git"
},
{
"lessThan": "337f966c00662d81ad82cf5a4bbb150b2e32c0d4",
"status": "affected",
"version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7",
"versionType": "git"
},
{
"lessThan": "12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc",
"status": "affected",
"version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7",
"versionType": "git"
},
{
"status": "affected",
"version": "8f1c022541bf5a923c8d6fa483112c15250f30a4",
"versionType": "git"
},
{
"status": "affected",
"version": "c4e8a172501e677ebd8ea9d9161d97dc4df56fbd",
"versionType": "git"
},
{
"lessThan": "5.10.265",
"status": "affected",
"version": "5.10.238",
"versionType": "semver"
},
{
"lessThan": "5.15.216",
"status": "affected",
"version": "5.15.185",
"versionType": "semver"
},
{
"lessThan": "6.1.183",
"status": "affected",
"version": "6.1.141",
"versionType": "semver"
},
{
"lessThan": "6.6.148",
"status": "affected",
"version": "6.6.93",
"versionType": "semver"
},
{
"lessThan": "6.12.101",
"status": "affected",
"version": "6.12.31",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.294",
"versionType": "semver"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/can/bcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.10.238",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.15.185",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "6.1.141",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "6.6.93",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "6.12.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.294",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: extend bcm_tx_lock usage for data and timer updates\n\nStage new CAN frame content for an existing tx op into a kmalloc()\u0027d\nbuffer and validate it there, mirroring the approach already used in\nbcm_rx_setup(). Only copy the validated data into op-\u003eframes while\nholding op-\u003ebcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler()\ncan no longer observe a partially updated or unvalidated frame.\n\nAdd a missing error path for memcpy_from_msg() when copying CAN frame\ndata from userspace.\n\nAlso move the kt_ival1/kt_ival2/ival1/ival2 updates in bcm_tx_setup()\nunder op-\u003ebcm_tx_lock, and read kt_ival1/kt_ival2/count under the same\nlock in bcm_tx_set_expiry() and bcm_tx_timeout_handler(), closing the\ntorn 64-bit ktime_t read on 32-bit platforms."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through PF_CAN/CAN_BCM socket sendmsg() TX_SETUP updates racing hrtimer-driven bcm_can_tx(); it is not triggered by remote network services or CAN bus traffic alone.\nAC:L - The attacker controls both sides of the race by creating cyclic TX ops with STARTTIMER/SETTIMER and repeatedly issuing TX_SETUP while the softirq hrtimer fires, making the window reliably winnable without external timing luck.\nPR:L - bcm_sendmsg()/bcm_connect() enforce no capability checks; any local user with access to a CAN interface (including vcan created with CAP_NET_ADMIN inside an unprivileged user namespace) can open BCM sockets and drive TX_SETUP.\nUI:N - Exploitation requires only the attacker opening a BCM socket and sending TX_SETUP messages; no victim interaction such as mounting filesystems or opening files is needed.\nS:U - Impact is confined to kernel memory/state corruption and local privilege effects on the host running CAN BCM; it does not cross a VM, container, or IOMMU security boundary by itself.\nC:H - Racing updates can let bcm_can_tx() transmit partially updated or unvalidated frames (e.g., len\u003e64) before bcm_tx_setup() rejects them, and many CAN driver xmit paths memcpy(cf-\u003edata, cf-\u003elen) trusting len, causing kernel out-of-bounds reads.\nI:H - Concurrent unsynchronized writes to op-\u003eframes, flags, count, and ktime_t timer fields corrupt shared in-kernel BCM state that directly feeds skb construction and driver transmission, providing attacker-influenced memory corruption primitives.\nA:H - Observing torn/unvalidated frames in bcm_can_tx() during active timers can trigger kernel WARN/Oops/panic via out-of-bounds accesses in CAN drivers, and torn ktime_t/count reads can disrupt cyclic transmission causing denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:36:13.917Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a538b072ee074c9b41b9d9c15a6861a963e30755"
},
{
"url": "https://git.kernel.org/stable/c/63422347b4c782f429748b2a09cd3cf3b77e6abd"
},
{
"url": "https://git.kernel.org/stable/c/37917e432e50b7de2b64230974380132a30f7270"
},
{
"url": "https://git.kernel.org/stable/c/52f06e7603780de100233713ddaf971d422e10ef"
},
{
"url": "https://git.kernel.org/stable/c/972fd66bb08fdef1090abe43196ca8da07216d13"
},
{
"url": "https://git.kernel.org/stable/c/bd46f55dec608daa44b45dcf3328517630ad8e40"
},
{
"url": "https://git.kernel.org/stable/c/337f966c00662d81ad82cf5a4bbb150b2e32c0d4"
},
{
"url": "https://git.kernel.org/stable/c/12ce799f7ab1e05bd8fbf79e46f403bfe5597ebc"
}
],
"title": "can: bcm: extend bcm_tx_lock usage for data and timer updates",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72119",
"datePublished": "2026-08-15T05:52:58.479Z",
"dateReserved": "2026-08-09T03:40:39.906Z",
"dateUpdated": "2026-08-19T16:36:13.917Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72121 (GCVE-0-2026-72121)
Vulnerability from cvelistv5 – Published: 2026-08-15 05:52 – Updated: 2026-08-19 16:36
VLAI
EPSS
VEX
Title
can: bcm: add locking when updating filter and timer values
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: add locking when updating filter and timer values
KCSAN detected a simultaneous access to timer values that can be
overwritten in bcm_rx_setup() when updating timer and filter content
while bcm_rx_handler(), bcm_rx_timeout_handler() or bcm_rx_thr_handler()
run concurrently on incoming CAN traffic.
Protect the timer (ival1/ival2/kt_ival1/kt_ival2/kt_lastmsg) and filter
(nframes/flags/frames/last_frames) updates in bcm_rx_setup() with a new
per-op bcm_rx_update_lock, taken with the matching scope in the RX
handlers. memcpy_from_msg() is staged into a temporary buffer before the
lock is taken, since it can sleep and must not run under a spinlock.
hrtimer_cancel() is always called without bcm_rx_update_lock held, since
bcm_rx_timeout_handler()/bcm_rx_thr_handler() take the same lock and a
running callback would otherwise deadlock against the canceller.
Also close a related race: bcm_rx_setup() cleared the RTR flag in the
stored reply frame's can_id as a separate, unprotected step after the
frame content was already installed, so a concurrent bcm_rx_handler()
could transmit a stale reply with CAN_RTR_FLAG still set. Fold that
normalization into the initial frame preparation instead (on the staged
buffer for updates, directly on op->frames pre-registration for new
ops), so the installed frame is always atomically self-consistent.
bcm_rx_handler()'s RX_RTR_FRAME check now takes a lock-protected
snapshot of op->flags before deciding whether to call bcm_can_tx(),
but does not hold the lock across that call.
Also take a lock-protected snapshot of the currframe in bcm_can_tx()
to avoid partly overwrites by content updates in bcm_tx_setup().
Finally check if a TX_RESET_MULTI_IDX/SETTIMER might have reset
op->currframe between the two locked sections in bcm_can_tx().
Omit calling hrtimer_forward() with zero interval in bcm_rx_thr_handler().
kt_ival2 may have been concurrently cleared by bcm_rx_setup() before it
cancels this timer, so check kt_ival2 inside the bcm_rx_update_lock.
Severity
8.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
7595de7bc56e0e52b74e56c90f7e247bf626d628 , < 96994180bd7b248b0cc698afe926e23fc1bda59b
(git)
Affected: fbd8fdc2b218e979cfe422b139b8f74c12419d1f , < caa8704a7f3cb7806331596195385437126ecb3a (git) Affected: 2a437b86ac5a9893c902f30ef66815bf13587bf6 , < a7c369e7da8203e2b5be12bbcac7b9ab2ed5b658 (git) Affected: 76c84c3728178b2d38d5604e399dfe8b0752645e , < a7eb6db1cd3f7b556a301dc1265945ad112089f7 (git) Affected: cc55dd28c20a6611e30596019b3b2f636819a4c0 , < 834cbca3b12e46887f7a9b35f1981a888360ea4c (git) Affected: c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 , < 19b1994069dd29478ba767de1f98f14a088198dc (git) Affected: c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 , < fc9f5ee1b073bd233d9c604e338af4ebb42cbc33 (git) Affected: c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 , < 749179c2e25b95d22499ed29096b3e02d6dfd2b4 (git) Affected: 8f1c022541bf5a923c8d6fa483112c15250f30a4 (git) Affected: c4e8a172501e677ebd8ea9d9161d97dc4df56fbd (git) Affected: 5.10.238 , < 5.10.265 (semver) Affected: 5.15.185 , < 5.15.216 (semver) Affected: 6.1.141 , < 6.1.183 (semver) Affected: 6.6.93 , < 6.6.148 (semver) Affected: 6.12.31 , < 6.12.101 (semver) Affected: 5.4.294 , < 5.5 (semver) Affected: 6.14.9 , < 6.15 (semver) |
|
| Linux | Linux |
Affected:
6.15
Unaffected: 0 , < 6.15 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/can/bcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "96994180bd7b248b0cc698afe926e23fc1bda59b",
"status": "affected",
"version": "7595de7bc56e0e52b74e56c90f7e247bf626d628",
"versionType": "git"
},
{
"lessThan": "caa8704a7f3cb7806331596195385437126ecb3a",
"status": "affected",
"version": "fbd8fdc2b218e979cfe422b139b8f74c12419d1f",
"versionType": "git"
},
{
"lessThan": "a7c369e7da8203e2b5be12bbcac7b9ab2ed5b658",
"status": "affected",
"version": "2a437b86ac5a9893c902f30ef66815bf13587bf6",
"versionType": "git"
},
{
"lessThan": "a7eb6db1cd3f7b556a301dc1265945ad112089f7",
"status": "affected",
"version": "76c84c3728178b2d38d5604e399dfe8b0752645e",
"versionType": "git"
},
{
"lessThan": "834cbca3b12e46887f7a9b35f1981a888360ea4c",
"status": "affected",
"version": "cc55dd28c20a6611e30596019b3b2f636819a4c0",
"versionType": "git"
},
{
"lessThan": "19b1994069dd29478ba767de1f98f14a088198dc",
"status": "affected",
"version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7",
"versionType": "git"
},
{
"lessThan": "fc9f5ee1b073bd233d9c604e338af4ebb42cbc33",
"status": "affected",
"version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7",
"versionType": "git"
},
{
"lessThan": "749179c2e25b95d22499ed29096b3e02d6dfd2b4",
"status": "affected",
"version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7",
"versionType": "git"
},
{
"status": "affected",
"version": "8f1c022541bf5a923c8d6fa483112c15250f30a4",
"versionType": "git"
},
{
"status": "affected",
"version": "c4e8a172501e677ebd8ea9d9161d97dc4df56fbd",
"versionType": "git"
},
{
"lessThan": "5.10.265",
"status": "affected",
"version": "5.10.238",
"versionType": "semver"
},
{
"lessThan": "5.15.216",
"status": "affected",
"version": "5.15.185",
"versionType": "semver"
},
{
"lessThan": "6.1.183",
"status": "affected",
"version": "6.1.141",
"versionType": "semver"
},
{
"lessThan": "6.6.148",
"status": "affected",
"version": "6.6.93",
"versionType": "semver"
},
{
"lessThan": "6.12.101",
"status": "affected",
"version": "6.12.31",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.294",
"versionType": "semver"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/can/bcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.10.238",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.15.185",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "6.1.141",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "6.6.93",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "6.12.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.294",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: add locking when updating filter and timer values\n\nKCSAN detected a simultaneous access to timer values that can be\noverwritten in bcm_rx_setup() when updating timer and filter content\nwhile bcm_rx_handler(), bcm_rx_timeout_handler() or bcm_rx_thr_handler()\nrun concurrently on incoming CAN traffic.\n\nProtect the timer (ival1/ival2/kt_ival1/kt_ival2/kt_lastmsg) and filter\n(nframes/flags/frames/last_frames) updates in bcm_rx_setup() with a new\nper-op bcm_rx_update_lock, taken with the matching scope in the RX\nhandlers. memcpy_from_msg() is staged into a temporary buffer before the\nlock is taken, since it can sleep and must not run under a spinlock.\n\nhrtimer_cancel() is always called without bcm_rx_update_lock held, since\nbcm_rx_timeout_handler()/bcm_rx_thr_handler() take the same lock and a\nrunning callback would otherwise deadlock against the canceller.\n\nAlso close a related race: bcm_rx_setup() cleared the RTR flag in the\nstored reply frame\u0027s can_id as a separate, unprotected step after the\nframe content was already installed, so a concurrent bcm_rx_handler()\ncould transmit a stale reply with CAN_RTR_FLAG still set. Fold that\nnormalization into the initial frame preparation instead (on the staged\nbuffer for updates, directly on op-\u003eframes pre-registration for new\nops), so the installed frame is always atomically self-consistent.\n\nbcm_rx_handler()\u0027s RX_RTR_FRAME check now takes a lock-protected\nsnapshot of op-\u003eflags before deciding whether to call bcm_can_tx(),\nbut does not hold the lock across that call.\n\nAlso take a lock-protected snapshot of the currframe in bcm_can_tx()\nto avoid partly overwrites by content updates in bcm_tx_setup().\nFinally check if a TX_RESET_MULTI_IDX/SETTIMER might have reset\nop-\u003ecurrframe between the two locked sections in bcm_can_tx().\n\nOmit calling hrtimer_forward() with zero interval in bcm_rx_thr_handler().\nkt_ival2 may have been concurrently cleared by bcm_rx_setup() before it\ncancels this timer, so check kt_ival2 inside the bcm_rx_update_lock."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The race is driven by concurrent CAN frame reception in bcm_rx_handler()/timer callbacks on a shared CAN segment (automotive OBD/ECU bus, factory controllers, CAN-USB adapters), an adjacent broadcast medium comparable to Bluetooth/WiFi segment access.\nAC:L - An attacker controls both race sides by flooding RX_SETUP via sendmsg while concurrently injecting matching CAN frames or armed timers; syzbot reliably reproduced the KCSAN race without timing conditions beyond attacker control.\nPR:N - CAN_BCM sockets impose no capability checks in can_create()/bcm_sendmsg(), and a bus participant can trigger the RX handler path without any Linux credentials while racing BCM configuration updates from local services.\nUI:N - Exploitation requires no victim interaction beyond normal background CAN/BCM activity on systems that already use the Broadcast Manager for monitoring or diagnostics.\nS:U - Impact is confined to kernel memory corruption and privilege boundaries within the same host; this is not a VM escape, IOMMU bypass, or cross-authority sandbox breakout.\nC:H - Unlocked concurrent updates to nframes/flags/frames/last_frames permit torn reads and out-of-bounds accesses in handler loops and timeout memset, matching the prior BCM race class that produced KASAN slab-out-of-bounds reads.\nI:H - Partial overwrites of op-\u003eframes during bcm_can_tx(), stale RTR replies transmitted on the bus, and size-mismatched memset/memcpy against concurrently shrinking buffers enable arbitrary CAN injection and kernel heap corruption.\nA:H - Concurrent timer corruption (hrtimer_forward with zero kt_ival2), torn structure fields, and heap corruption from racing memset/copy operations can cause kernel oops, panic, or sustained denial of service on CAN-equipped systems."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:36:16.520Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/96994180bd7b248b0cc698afe926e23fc1bda59b"
},
{
"url": "https://git.kernel.org/stable/c/caa8704a7f3cb7806331596195385437126ecb3a"
},
{
"url": "https://git.kernel.org/stable/c/a7c369e7da8203e2b5be12bbcac7b9ab2ed5b658"
},
{
"url": "https://git.kernel.org/stable/c/a7eb6db1cd3f7b556a301dc1265945ad112089f7"
},
{
"url": "https://git.kernel.org/stable/c/834cbca3b12e46887f7a9b35f1981a888360ea4c"
},
{
"url": "https://git.kernel.org/stable/c/19b1994069dd29478ba767de1f98f14a088198dc"
},
{
"url": "https://git.kernel.org/stable/c/fc9f5ee1b073bd233d9c604e338af4ebb42cbc33"
},
{
"url": "https://git.kernel.org/stable/c/749179c2e25b95d22499ed29096b3e02d6dfd2b4"
}
],
"title": "can: bcm: add locking when updating filter and timer values",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72121",
"datePublished": "2026-08-15T05:52:59.959Z",
"dateReserved": "2026-08-09T03:40:39.907Z",
"dateUpdated": "2026-08-19T16:36:16.520Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72124 (GCVE-0-2026-72124)
Vulnerability from cvelistv5 – Published: 2026-08-15 05:53 – Updated: 2026-08-19 16:36
VLAI
EPSS
VEX
Title
can: isotp: serialize TX state transitions under so->rx_lock
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: isotp: serialize TX state transitions under so->rx_lock
The TX state machine (so->tx.state) is driven from three contexts:
sendmsg() claiming and progressing a transfer, the RX path consuming
Flow Control/echo frames, and two hrtimers timing out a stalled
transfer. Mixing a lock-free cmpxchg() claim in sendmsg() with
hrtimer_cancel() calls made under so->rx_lock elsewhere left windows
where a frame or timer callback could act on a state that had already
moved on, corrupting an unrelated transfer.
so->rx_lock now covers the full lifecycle of a TX claim: sendmsg()
takes it to check so->tx.state is ISOTP_IDLE, switch it to
ISOTP_SENDING, bump so->tx_gen and drain the previous transfer's
timers - all as one critical section. isotp_rcv_fc()/isotp_rcv_cf()
already run under this lock via isotp_rcv(), and isotp_rcv_echo() now
takes it itself, so none of them can ever observe a transfer mid-claim.
This also means a transfer can no longer be handed to sendmsg()'s
cleanup paths (signal or send error) while another thread is
concurrently claiming or finishing it, so those paths can cancel
timers and reset the state unconditionally.
isotp_release() claims the socket the same way, so a racing sendmsg()
sees a consistent ISOTP_SHUTDOWN and skips arming its timer or sending.
Only the hrtimer callbacks stay outside so->rx_lock, since they run
under so->rx_lock's cancellation elsewhere and taking it themselves
would deadlock. so->tx_gen lets them recognize whether the transfer
they timed out is still the one currently active, so they don't
report an error against a transfer that has since completed or been
superseded.
Severity
8.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e057dd3fc20ffb3d7f150af46542a51b59b90127 , < bbedeb67a9a684f2fb78c55bd3662c400526715e
(git)
Affected: e057dd3fc20ffb3d7f150af46542a51b59b90127 , < 377a8f500704da42ed86a4541ed930e9dcfdb2ea (git) Affected: e057dd3fc20ffb3d7f150af46542a51b59b90127 , < 6da8119e8dd542194103139812d1a4b7dcd1aedd (git) Affected: e057dd3fc20ffb3d7f150af46542a51b59b90127 , < 0b05eca9589f609e2491b528dccf683168a4cda8 (git) Affected: e057dd3fc20ffb3d7f150af46542a51b59b90127 , < a7d90e7b5e75d7406c889fe36e9a61ee364a00cb (git) Affected: e057dd3fc20ffb3d7f150af46542a51b59b90127 , < 37beb16e08cae94cc05840c7274225e3b0b38ae7 (git) Affected: e057dd3fc20ffb3d7f150af46542a51b59b90127 , < 4f1fdf1a1c317bcac0c6b6c8e12642c9983de1ca (git) Affected: e057dd3fc20ffb3d7f150af46542a51b59b90127 , < cf070fe33bfbd1a4c21236078fadb35dd223a157 (git) |
|
| Linux | Linux |
Affected:
5.10
Unaffected: 0 , < 5.10 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/can/isotp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bbedeb67a9a684f2fb78c55bd3662c400526715e",
"status": "affected",
"version": "e057dd3fc20ffb3d7f150af46542a51b59b90127",
"versionType": "git"
},
{
"lessThan": "377a8f500704da42ed86a4541ed930e9dcfdb2ea",
"status": "affected",
"version": "e057dd3fc20ffb3d7f150af46542a51b59b90127",
"versionType": "git"
},
{
"lessThan": "6da8119e8dd542194103139812d1a4b7dcd1aedd",
"status": "affected",
"version": "e057dd3fc20ffb3d7f150af46542a51b59b90127",
"versionType": "git"
},
{
"lessThan": "0b05eca9589f609e2491b528dccf683168a4cda8",
"status": "affected",
"version": "e057dd3fc20ffb3d7f150af46542a51b59b90127",
"versionType": "git"
},
{
"lessThan": "a7d90e7b5e75d7406c889fe36e9a61ee364a00cb",
"status": "affected",
"version": "e057dd3fc20ffb3d7f150af46542a51b59b90127",
"versionType": "git"
},
{
"lessThan": "37beb16e08cae94cc05840c7274225e3b0b38ae7",
"status": "affected",
"version": "e057dd3fc20ffb3d7f150af46542a51b59b90127",
"versionType": "git"
},
{
"lessThan": "4f1fdf1a1c317bcac0c6b6c8e12642c9983de1ca",
"status": "affected",
"version": "e057dd3fc20ffb3d7f150af46542a51b59b90127",
"versionType": "git"
},
{
"lessThan": "cf070fe33bfbd1a4c21236078fadb35dd223a157",
"status": "affected",
"version": "e057dd3fc20ffb3d7f150af46542a51b59b90127",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/can/isotp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: isotp: serialize TX state transitions under so-\u003erx_lock\n\nThe TX state machine (so-\u003etx.state) is driven from three contexts:\nsendmsg() claiming and progressing a transfer, the RX path consuming\nFlow Control/echo frames, and two hrtimers timing out a stalled\ntransfer. Mixing a lock-free cmpxchg() claim in sendmsg() with\nhrtimer_cancel() calls made under so-\u003erx_lock elsewhere left windows\nwhere a frame or timer callback could act on a state that had already\nmoved on, corrupting an unrelated transfer.\n\nso-\u003erx_lock now covers the full lifecycle of a TX claim: sendmsg()\ntakes it to check so-\u003etx.state is ISOTP_IDLE, switch it to\nISOTP_SENDING, bump so-\u003etx_gen and drain the previous transfer\u0027s\ntimers - all as one critical section. isotp_rcv_fc()/isotp_rcv_cf()\nalready run under this lock via isotp_rcv(), and isotp_rcv_echo() now\ntakes it itself, so none of them can ever observe a transfer mid-claim.\nThis also means a transfer can no longer be handed to sendmsg()\u0027s\ncleanup paths (signal or send error) while another thread is\nconcurrently claiming or finishing it, so those paths can cancel\ntimers and reset the state unconditionally.\n\nisotp_release() claims the socket the same way, so a racing sendmsg()\nsees a consistent ISOTP_SHUTDOWN and skips arming its timer or sending.\n\nOnly the hrtimer callbacks stay outside so-\u003erx_lock, since they run\nunder so-\u003erx_lock\u0027s cancellation elsewhere and taking it themselves\nwould deadlock. so-\u003etx_gen lets them recognize whether the transfer\nthey timed out is still the one currently active, so they don\u0027t\nreport an error against a transfer that has since completed or been\nsuperseded."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The bug is hit on the SocketCAN receive path (can_rcv\u2192isotp_rcv/isotp_rcv_echo for FC/echo frames) racing sendmsg() and hrtimers; in automotive/industrial ISO-TP (UDS) deployments an attacker on the same CAN segment can inject timed FC/echo frames without host shell access.\nAC:L - The attacker controls both sides of the race via concurrent sendmsg()/close() threads plus crafted FC/echo traffic and timer timing; sashiko-bot/syzkaller reproduces it reliably with no conditions outside attacker influence.\nPR:N - Once a victim ISO-TP socket is bound and transmitting (normal diagnostic behavior), an unauthenticated CAN bus peer needs no Linux credentials; CAN_ISOTP socket create/bind/sendmsg paths impose no capability checks.\nUI:N - No victim interaction beyond routine background ISO-TP traffic on an already-bound socket; the attacker drives concurrent transfers and FC/echo timing to hit the unsynchronized TX state transitions.\nS:U - Impact is kernel ISO-TP/socket heap corruption within the same OS security authority, without inherent VM escape, container breakout, or IOMMU boundary crossing.\nC:H - Mis-serialized so-\u003etx.state, tx.idx, and rx reassembly state lets stale echo/FC/timer handlers operate on the wrong transfer, enabling out-of-bounds reads from tpcon tx/rx buffers and adjacent kernel heap disclosure.\nI:H - The same cross-transfer corruption writes through tpcon buffers and socket state (indices, sequence numbers, timers), yielding attacker-influenced kernel heap corruption rather than a benign protocol error.\nA:H - Stale timers and handlers acting on superseded transfers can provoke sk_err storms, skb/state corruption, and kernel oops/panic in softirq/timer context, matching prior isotp timer race failures and repeatable DoS."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:36:21.129Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bbedeb67a9a684f2fb78c55bd3662c400526715e"
},
{
"url": "https://git.kernel.org/stable/c/377a8f500704da42ed86a4541ed930e9dcfdb2ea"
},
{
"url": "https://git.kernel.org/stable/c/6da8119e8dd542194103139812d1a4b7dcd1aedd"
},
{
"url": "https://git.kernel.org/stable/c/0b05eca9589f609e2491b528dccf683168a4cda8"
},
{
"url": "https://git.kernel.org/stable/c/a7d90e7b5e75d7406c889fe36e9a61ee364a00cb"
},
{
"url": "https://git.kernel.org/stable/c/37beb16e08cae94cc05840c7274225e3b0b38ae7"
},
{
"url": "https://git.kernel.org/stable/c/4f1fdf1a1c317bcac0c6b6c8e12642c9983de1ca"
},
{
"url": "https://git.kernel.org/stable/c/cf070fe33bfbd1a4c21236078fadb35dd223a157"
}
],
"title": "can: isotp: serialize TX state transitions under so-\u003erx_lock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72124",
"datePublished": "2026-08-15T05:53:02.172Z",
"dateReserved": "2026-08-09T03:40:39.907Z",
"dateUpdated": "2026-08-19T16:36:21.129Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72125 (GCVE-0-2026-72125)
Vulnerability from cvelistv5 – Published: 2026-08-15 05:53 – Updated: 2026-08-19 16:36
VLAI
EPSS
VEX
Title
can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
isotp_release() looked up the bound network device via dev_get_by_index()
using the stored ifindex. During device unregistration the device is
unlisted from the ifindex hash before the NETDEV_UNREGISTER notifier
chain runs, so a concurrent isotp_release() could find no device, skip
can_rx_unregister() entirely, and still proceed to free the socket.
Since isotp_release() had already removed itself from the isotp
notifier list at that point, isotp_notify() would never get a chance to
clean up either, leaving a stale CAN filter that keeps pointing at the
freed socket.
Fix this the same way raw.c already does: hold a tracked reference to
the bound net_device in the socket (so->dev/so->dev_tracker) from
bind() onward instead of re-resolving it from the ifindex, and
serialize bind()/release() with rtnl_lock() so that so->dev is always
consistent with what the NETDEV_UNREGISTER notifier sees. so->dev
stays valid regardless of ifindex-hash unlisting, and is only ever
cleared by whichever of isotp_release()/isotp_notify() gets there
first, so the filter is always removed exactly once.
isotp_bind() now rejects a (re)bind with -EAGAIN while so->[tx|rx].state
isn't ISOTP_IDLE yet, so a timer left running by a prior
NETDEV_UNREGISTER can't act on a newly bound so->ifindex. Both checks
share the same lock_sock() section, so there is no window in which a
concurrent isotp_notify() clearing so->bound could be missed.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e057dd3fc20ffb3d7f150af46542a51b59b90127 , < f311bbb29bb06aaab69ba45a6e4b11323d20b8f9
(git)
Affected: e057dd3fc20ffb3d7f150af46542a51b59b90127 , < 8e018f4335590460ebcf0c2b493ed38ba1a35204 (git) Affected: e057dd3fc20ffb3d7f150af46542a51b59b90127 , < 33b9cd9245e2a4b800f99ed1cc53d64960614152 (git) Affected: e057dd3fc20ffb3d7f150af46542a51b59b90127 , < 0b811c4bbe3ec9ad611e90a540fe8b51b3bb8a96 (git) Affected: e057dd3fc20ffb3d7f150af46542a51b59b90127 , < 43884dc7963beef2328f507f4fe680bdc173eb80 (git) Affected: e057dd3fc20ffb3d7f150af46542a51b59b90127 , < 7bef39ba76eb7307ed22a50329e0f5776dbeda58 (git) Affected: e057dd3fc20ffb3d7f150af46542a51b59b90127 , < e442b62ba5a7756c17e05a77b32cdd085a2b6138 (git) Affected: e057dd3fc20ffb3d7f150af46542a51b59b90127 , < 20bab8b88baac140ca3701116e1d486c7f51e311 (git) |
|
| Linux | Linux |
Affected:
5.10
Unaffected: 0 , < 5.10 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/can/isotp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f311bbb29bb06aaab69ba45a6e4b11323d20b8f9",
"status": "affected",
"version": "e057dd3fc20ffb3d7f150af46542a51b59b90127",
"versionType": "git"
},
{
"lessThan": "8e018f4335590460ebcf0c2b493ed38ba1a35204",
"status": "affected",
"version": "e057dd3fc20ffb3d7f150af46542a51b59b90127",
"versionType": "git"
},
{
"lessThan": "33b9cd9245e2a4b800f99ed1cc53d64960614152",
"status": "affected",
"version": "e057dd3fc20ffb3d7f150af46542a51b59b90127",
"versionType": "git"
},
{
"lessThan": "0b811c4bbe3ec9ad611e90a540fe8b51b3bb8a96",
"status": "affected",
"version": "e057dd3fc20ffb3d7f150af46542a51b59b90127",
"versionType": "git"
},
{
"lessThan": "43884dc7963beef2328f507f4fe680bdc173eb80",
"status": "affected",
"version": "e057dd3fc20ffb3d7f150af46542a51b59b90127",
"versionType": "git"
},
{
"lessThan": "7bef39ba76eb7307ed22a50329e0f5776dbeda58",
"status": "affected",
"version": "e057dd3fc20ffb3d7f150af46542a51b59b90127",
"versionType": "git"
},
{
"lessThan": "e442b62ba5a7756c17e05a77b32cdd085a2b6138",
"status": "affected",
"version": "e057dd3fc20ffb3d7f150af46542a51b59b90127",
"versionType": "git"
},
{
"lessThan": "20bab8b88baac140ca3701116e1d486c7f51e311",
"status": "affected",
"version": "e057dd3fc20ffb3d7f150af46542a51b59b90127",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/can/isotp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER\n\nisotp_release() looked up the bound network device via dev_get_by_index()\nusing the stored ifindex. During device unregistration the device is\nunlisted from the ifindex hash before the NETDEV_UNREGISTER notifier\nchain runs, so a concurrent isotp_release() could find no device, skip\ncan_rx_unregister() entirely, and still proceed to free the socket.\nSince isotp_release() had already removed itself from the isotp\nnotifier list at that point, isotp_notify() would never get a chance to\nclean up either, leaving a stale CAN filter that keeps pointing at the\nfreed socket.\n\nFix this the same way raw.c already does: hold a tracked reference to\nthe bound net_device in the socket (so-\u003edev/so-\u003edev_tracker) from\nbind() onward instead of re-resolving it from the ifindex, and\nserialize bind()/release() with rtnl_lock() so that so-\u003edev is always\nconsistent with what the NETDEV_UNREGISTER notifier sees. so-\u003edev\nstays valid regardless of ifindex-hash unlisting, and is only ever\ncleared by whichever of isotp_release()/isotp_notify() gets there\nfirst, so the filter is always removed exactly once.\n\nisotp_bind() now rejects a (re)bind with -EAGAIN while so-\u003e[tx|rx].state\nisn\u0027t ISOTP_IDLE yet, so a timer left running by a prior\nNETDEV_UNREGISTER can\u0027t act on a newly bound so-\u003eifindex. Both checks\nshare the same lock_sock() section, so there is no window in which a\nconcurrent isotp_notify() clearing so-\u003ebound could be missed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local AF_CAN ISO-TP socket operations (socket/bind/close) racing NETDEV_UNREGISTER on the bound CAN interface; stale-filter UAF is triggered via local frame injection or an existing bound interface, not a remote IP/network service.\nAC:L - The attacker controls both sides of the race by concurrently closing the ISO-TP socket and unregistering the bound CAN device (e.g., vcan create/delete with CAP_NET_ADMIN in a user namespace), and can retry until the stale RX filter is left on a freed socket.\nPR:L - No init-namespace root is required: any local user can open CAN_ISOTP sockets, and CAP_NET_ADMIN obtainable in user namespaces suffices to create/delete vcan and drive the unregister path used in automotive/embedded ISO-TP (UDS) deployments.\nUI:N - No victim interaction is needed; the use-after-free is triggered by the attacker\u0027s own concurrent close()/NETDEV_UNREGISTER operations and subsequent CAN frames sent to the bound IDs.\nS:U - Impact is kernel heap corruption and potential privilege escalation within the same OS security boundary; it does not inherently cross VM, container, or IOMMU isolation boundaries.\nC:H - A stale can_rx filter keeps calling isotp_rcv()/isotp_rcv_echo() with a freed isotp_sock, enabling reads of reallocated slab contents through socket state, sock_queue_rcv_skb(), and protocol parsing on attacker-influenced memory.\nI:H - The UAF path performs extensive writes to freed socket state (RX/TX buffers, timers, generation counters) and can emit CAN traffic, providing primitives for heap shaping and control-flow hijack rather than a crash-only fault.\nA:H - Use-after-free in softirq CAN receive callbacks commonly causes kernel oops/panic from dereferencing or writing freed isotp_sock/timer state, even before reliable exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:36:23.877Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f311bbb29bb06aaab69ba45a6e4b11323d20b8f9"
},
{
"url": "https://git.kernel.org/stable/c/8e018f4335590460ebcf0c2b493ed38ba1a35204"
},
{
"url": "https://git.kernel.org/stable/c/33b9cd9245e2a4b800f99ed1cc53d64960614152"
},
{
"url": "https://git.kernel.org/stable/c/0b811c4bbe3ec9ad611e90a540fe8b51b3bb8a96"
},
{
"url": "https://git.kernel.org/stable/c/43884dc7963beef2328f507f4fe680bdc173eb80"
},
{
"url": "https://git.kernel.org/stable/c/7bef39ba76eb7307ed22a50329e0f5776dbeda58"
},
{
"url": "https://git.kernel.org/stable/c/e442b62ba5a7756c17e05a77b32cdd085a2b6138"
},
{
"url": "https://git.kernel.org/stable/c/20bab8b88baac140ca3701116e1d486c7f51e311"
}
],
"title": "can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72125",
"datePublished": "2026-08-15T05:53:02.905Z",
"dateReserved": "2026-08-09T03:40:39.907Z",
"dateUpdated": "2026-08-19T16:36:23.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…
Loading…