CVE-2026-72116

Received Received - Intake

CAN Bus BCM Module Use-After-Free in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix stale rx/tx ops after device removal RX: an RX_SETUP update(!) for an existing op skipped can_rx_register() unconditionally, even when a concurrent NETDEV_UNREGISTER had already torn down its registration (op->rx_reg_dev == NULL). This silently did not re-enable frame delivery for that updated filter. bcm_rx_setup() now re-registers in that case, while leaving rx_ops with ifindex = 0 (all CAN devices) which never carry a tracked rx_reg_dev registered as-is. TX: bcm_notify() only handled bo->rx_ops on NETDEV_UNREGISTER, leaving tx_ops with an active cyclic transmission re-arming its hrtimer indefinitely to execute bcm_tx_timeout_handler(). Cancelling the hrtimer prevents the runaway timer and any injection into a later reused ifindex, since nothing else calls bcm_can_tx() for the op until an explicit TX_SETUP update re-arms it. Unlike bcm_rx_unreg(), which clears the tracked rx_reg_dev for rx_ops, the ifindex is intentionally left unchanged for tx_ops. bcm_tx_setup() always rejects ifindex 0, so clearing it would strand the op: neither a later TX_SETUP (bcm_find_op()) nor TX_DELETE (bcm_delete_tx_op()) could ever find it again, since both require an exact ifindex match.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72116

EUVD

EUVD-2026-59074

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel's CAN BCM protocol allows stale RX/TX operations to persist after device removal. For RX, an update to an existing filter fails to re-enable frame delivery if the device was unregistered concurrently. For TX, a cyclic transmission timer continues running indefinitely after device removal, potentially injecting data into a reused interface.

Detection Guidance

This vulnerability affects the CAN bus subsystem in the Linux kernel, specifically the bcm module. Detection requires checking kernel logs for CAN-related errors or examining the bcm module state. Commands like dmesg | grep -i can or lsmod | grep bcm may help identify issues. Monitor for stale rx/tx operations after device removal events.

Impact Analysis

This could lead to unintended CAN frame processing after device removal, causing data corruption or security issues. The stale TX timer might inject invalid data into a new interface, while stale RX filters could miss legitimate traffic or process outdated data.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to CAN bus operations in the Linux kernel. It involves a flaw in the CAN broadcast manager (bcm) subsystem that could lead to stale operations after device removal, but does not involve data handling, privacy, or security controls typically regulated by these standards.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-72116. This vulnerability affects the CAN BCM protocol in the kernel, so applying the official patch is the primary mitigation step.

Hi! I’m here to help you understand CVE-2026-72116. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70