Unknown

CVE-2026-72118 — can: bcm: fix CAN frame rx/tx statistics

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix CAN frame rx/tx statistics KCSAN detected a data race within the bcm_rx_handler() when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs. Use atomic operations with (signed) long data types to access the statistics in the hot path to fix the KCSAN complaint. Additionally simplify the update and check of statistics overflow by using the atomic operations in separate bcm_update_[rx|tx]_stats() functions. The rx variant runs under bcm_rx_update_lock to prevent races when resetting the two rx counters; the tx variant runs under bcm_tx_lock and only needs to guard its own counter's overflow. As the rx path resets its values already at LONG_MAX / 100, there is no conflict between the two locking domains (bcm_rx_update_lock vs. bcm_tx_lock) even for ops that use both paths. The rx statistics update and the frames_filtered update in bcm_rx_changed() were previously performed in two separate bcm_rx_update_lock sections. For an rx op subscribed on all interfaces (ifindex == 0), bcm_rx_handler() can run concurrently on different CPUs, so a counter reset by one CPU between these two sections could leave frames_filtered larger than frames_abs on another CPU, producing a bogus (even negative) reduction percentage in procfs. Update the statistics in the same critical section as bcm_rx_changed() to close this gap, which also removes the now unneeded extra lock/unlock pair around the traffic_flags calculation.

Published Aug 15, 2026 · Updated Oct 15, 2026 · Sources: NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP · CNA: Linux

Low

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

No exploitation signal in the sources consulted so far.

How the score was calculated

EPSS 0.2% (30-day exploitation probability)+2

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation

Not confirmed

Not in CISA KEV — an absence of record, not proof it is unexploited.

EPSS FIRST

0.22%

ahead of 12% of scored CVEs · Oct 30, 2026

Affects

Linux

CVSS base

—

Score not published yet.

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

Identify exposed assets running the affected vendor/product/version combinations (Linux Linux).
No fix documented in the sources: reduce exposure and monitor the vendor advisory.
Search available logs for exploit probes, errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

Vendor	Product	Versions	Status	Source
Linux	Linux	≥ ffd980f976e7fd666c2e61bf8ab35107efd11828 and < 640acf3566fc897065127001be875ebc5401c218≥ ffd980f976e7fd666c2e61bf8ab35107efd11828 and < 47fca0d1620f2d4fab0677564989ef2b9c225c66≥ ffd980f976e7fd666c2e61bf8ab35107efd11828 and < fd75884eae40a7be47867cbfc9fc84a80bb8ddb4≥ ffd980f976e7fd666c2e61bf8ab35107efd11828 and < 8b2783172d92edd650de6006ebd1c800937021ab≥ ffd980f976e7fd666c2e61bf8ab35107efd11828 and < 970caff5c1a63702c80e08d920256bcb5f88ecc5≥ ffd980f976e7fd666c2e61bf8ab35107efd11828 and < 8104bcdb2612fdda95169ddc3b49747b2ff98d24≥ ffd980f976e7fd666c2e61bf8ab35107efd11828 and < df47f07cdc801a6afe05a486b5a343c3e532a93c≥ ffd980f976e7fd666c2e61bf8ab35107efd11828 and < e6c24ba95fc3f1b5e1dcd28b1c6e59ef61a9daa5 and 1 more version 2.6.25	Vulnerable	CVE Program (cve.org) e CISA ADP

EPSS over time FIRST

Oct 15, 2026 → Oct 30, 2026 · 15 reading(s) · max 0.22%

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

Not enough vector or weakness data: use the affected application’s logs as a starting point.

application logs

Timeline

What happened to this CVE, newest first.

2026
Record published
Oct 15, 2026
Affected products added · linux/linux
Oct 15, 2026 · CVE Program (cve.org) e CISA ADP
Source status changed · → Received
Oct 15, 2026 · NIST National Vulnerability Database
Record created in this database
Oct 15, 2026 · NIST National Vulnerability Database
CVE published
Aug 15, 2026 · Linux

Source activity

Repeated readings are counted rather than listed.

1× Official description updated · Oct 15, 2026 – Oct 15, 2026

References

8 on the record

git.kernel.org/stable/c/fd75884eae40a7be47867cbfc9fc84a80bb8ddb4
NIST National Vulnerability Database
git.kernel.org/stable/c/8104bcdb2612fdda95169ddc3b49747b2ff98d24
NIST National Vulnerability Database
git.kernel.org/stable/c/e6c24ba95fc3f1b5e1dcd28b1c6e59ef61a9daa5
NIST National Vulnerability Database
git.kernel.org/stable/c/640acf3566fc897065127001be875ebc5401c218
NIST National Vulnerability Database
git.kernel.org/stable/c/970caff5c1a63702c80e08d920256bcb5f88ecc5
NIST National Vulnerability Database
git.kernel.org/stable/c/47fca0d1620f2d4fab0677564989ef2b9c225c66
NIST National Vulnerability Database
git.kernel.org/stable/c/8b2783172d92edd650de6006ebd1c800937021ab
NIST National Vulnerability Database
git.kernel.org/stable/c/df47f07cdc801a6afe05a486b5a343c3e532a93c
NIST National Vulnerability Database

Elsewhere on this site

Linux
every CVE for this vendor

Related CVEs (same products)

Unknown CVE-2026-99216 Drivers: hv: Don't reset VMBus connection state on error/exit paths 2d
Unknown CVE-2026-99215 power: supply: core: prevent unregistering a power supply while a callback runs 2d
Unknown CVE-2026-99207 scsi: target: Disable interrupts while holding delayed_cmd_lock 2d
Unknown CVE-2026-99208 drm/xe/oa: Zero OA buffer at allocation 2d
Unknown CVE-2026-99209 drm/xe: skip eviction of a BO with no resource 2d
Unknown CVE-2026-99210 accel/rocket: clear rdev on device init failure 2d

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No CVSS score published by NVD, the CNA, CISA or GitHub so far.
No fixed version, patch or mitigation documented.
No CISA SSVC assessment.
No CWE classification.
No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2026-72118 is "can: bcm: fix CAN frame rx/tx statistics", rated Unknown. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. EPSS 0.22% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.