CVE-2026-72121 — can: bcm: add locking when updating filter and timer values
In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and timer values KCSAN detected a simultaneous access to timer values that can be overwritten in bcm_rx_setup() when updating timer and filter content while bcm_rx_handler(), bcm_rx_timeout_handler() or bcm_rx_thr_handler() run concurrently on incoming CAN traffic. Protect the timer (ival1/ival2/kt_ival1/kt_ival2/kt_lastmsg) and filter (nframes/flags/frames/last_frames) updates in bcm_rx_setup() with a new per-op bcm_rx_update_lock, taken with the matching scope in the RX handlers. memcpy_from_msg() is staged into a temporary buffer before the lock is taken, since it can sleep and must not run under a spinlock. hrtimer_cancel() is always called without bcm_rx_update_lock held, since bcm_rx_timeout_handler()/bcm_rx_thr_handler() take the same lock and a running callback would otherwise deadlock against the canceller. Also close a related race: bcm_rx_setup() cleared the RTR flag in the stored reply frame's can_id as a separate, unprotected step after the frame content was already installed, so a concurrent bcm_rx_handler() could transmit a stale reply with CAN_RTR_FLAG still set. Fold that normalization into the initial frame preparation instead (on the staged buffer for updates, directly on op->frames pre-registration for new ops), so the installed frame is always atomically self-consistent. bcm_rx_handler()'s RX_RTR_FRAME check now takes a lock-protected snapshot of op->flags before deciding whether to call bcm_can_tx(), but does not hold the lock across that call. Also take a lock-protected snapshot of the currframe in bcm_can_tx() to avoid partly overwrites by content updates in bcm_tx_setup(). Finally check if a TX_RESET_MULTI_IDX/SETTIMER might have reset op->currframe between the two locked sections in bcm_can_tx(). Omit calling hrtimer_forward() with zero interval in bcm_rx_thr_handler(). kt_ival2 may have been concurrently cleared by bcm_rx_setup() before it cancels this timer, so check kt_ival2 inside the bcm_rx_update_lock.
Who exploits it and how urgent it is
A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.
How the score was calculated
- Technical severity (high)+6
The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).
Triage
Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.
Remediation
Fixes and mitigations documented by the sources — linked to the original advisory.
No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.
First 24 hours
Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.
- Identify exposed assets running the affected vendor/product/version combinations (Linux Linux).
- No fix documented in the sources: reduce exposure and monitor the vendor advisory.
- Search available logs for exploit probes, errors and authentication anomalies.
Affected scope
Vendor, product and versions as the sources word them.
| Vendor | Product | Versions | Status | Source |
|---|---|---|---|---|
| Linux | Linux |
version c4e8a172501e677ebd8ea9d9161d97dc4df56fbdversion 6.15≥ 6.14.9 and < 6.15≥ 5.4.294 and < 5.5≥ 6.12.31 and < 6.12.101≥ 6.6.93 and < 6.6.148≥ 6.1.141 and < 6.1.183≥ 5.15.185 and < 5.15.216 and 10 more≥ 5.10.238 and < 5.10.265≥ 7595de7bc56e0e52b74e56c90f7e247bf626d628 and < 96994180bd7b248b0cc698afe926e23fc1bda59bversion 8f1c022541bf5a923c8d6fa483112c15250f30a4≥ c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 and < 749179c2e25b95d22499ed29096b3e02d6dfd2b4≥ c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 and < fc9f5ee1b073bd233d9c604e338af4ebb42cbc33≥ c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 and < 19b1994069dd29478ba767de1f98f14a088198dc≥ cc55dd28c20a6611e30596019b3b2f636819a4c0 and < 834cbca3b12e46887f7a9b35f1981a888360ea4c≥ 76c84c3728178b2d38d5604e399dfe8b0752645e and < a7eb6db1cd3f7b556a301dc1265945ad112089f7≥ 2a437b86ac5a9893c902f30ef66815bf13587bf6 and < a7c369e7da8203e2b5be12bbcac7b9ab2ed5b658≥ fbd8fdc2b218e979cfe422b139b8f74c12419d1f and < caa8704a7f3cb7806331596195385437126ecb3a |
Vulnerable | CVE Program (cve.org) e CISA ADP |
Attack characteristics
The CVSS vector, decoded. It describes the attack, not your exposure to it.
Every base score collected
Sources score independently and may disagree; each row says who scored it and under which version.
| Score | Version | Severity | Expl. | Impact | Scored by |
|---|---|---|---|---|---|
| 8.8 | CVSS 3.1 | High | 2.8 | 5.9 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 via NIST National Vulnerability Database |
| 8.8 | CVSS 3.1 | High | — | — | Linux via CVE Program (cve.org) e CISA ADP |
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (score shown at the top: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) Detection
Read off the CVSS vector and the weakness class. Starting points, not tested rules.
- Not enough vector or weakness data: use the affected application’s logs as a starting point.
Timeline
What happened to this CVE, newest first.
- 2026
- Affected products added · linux/linux
- Record published
- CVSS changed · 8.8
- Source status changed · → Received
- Record created in this database
- CVE published
Source activity
Repeated readings are counted rather than listed.
- 1× Official description updated · Oct 15, 2026 – Oct 15, 2026
References
8 on the record
- git.kernel.org/stable/c/caa8704a7f3cb7806331596195385437126ecb3a
- git.kernel.org/stable/c/a7c369e7da8203e2b5be12bbcac7b9ab2ed5b658
- git.kernel.org/stable/c/749179c2e25b95d22499ed29096b3e02d6dfd2b4
- git.kernel.org/stable/c/834cbca3b12e46887f7a9b35f1981a888360ea4c
- git.kernel.org/stable/c/fc9f5ee1b073bd233d9c604e338af4ebb42cbc33
- git.kernel.org/stable/c/a7eb6db1cd3f7b556a301dc1265945ad112089f7
- git.kernel.org/stable/c/96994180bd7b248b0cc698afe926e23fc1bda59b
- git.kernel.org/stable/c/19b1994069dd29478ba767de1f98f14a088198dc
Elsewhere on this site
Related CVEs (same products)
- Critical CVE-2026-99999 ipv4: validate checksum_start before completing checksum 13h
- Unknown CVE-2026-98432 ipv4: free inet_opt and ireq_opt after an RCU grace period 13h
- Unknown CVE-2026-98424 wifi: cfg80211: undo netns switch if renaming the wiphy fails 1d
- Unknown CVE-2026-98425 wifi: mac80211: don't warn when an IBSS has no channel to scan 1d
- Unknown CVE-2026-98426 wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path 1d
- Unknown CVE-2026-98427 net/sched: codel: bound the dropping loop per dequeue call 1d
Not in any source we poll
Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.
- No FIRST EPSS score.
- No fixed version, patch or mitigation documented.
- No CISA SSVC assessment.
- No CWE classification.
- No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
- No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
- No exploit packet captures, log samples, or incident case IDs supplied.
Answered from this record
Text assembled only from the fields above — no additional claims.
What should defenders know first?
CVE-2026-72121 is "can: bcm: add locking when updating filter and timer values", rated High. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. CVSS 8.8 describes technical severity. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.
Comments
Moderated technical discussion. Read the community guidelines.
No comments yet.
Sign in or create an account to comment and suggest corrections.