CVE-2026-72120
Received Received - Intake

Missing RCU List Operations in Linux Kernel CAN BCM

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu list annotations and operations sashiko-bot remarked the missing use of list_add_rcu() in bcm_[rx|tx]_setup() to have a proper initialized bcm_op structure when bcm_proc_show() traverses the bcm_op's under rcu_read_lock(). To cover all initial settings of the bcm_op's the list_add_rcu() calls are moved to the end of the setup code. While at it, also fix the mirroring removal side: bcm_release() called bcm_remove_op() - which frees the op via call_rcu() - on ops that were still linked in bo->tx_ops/bo->rx_ops, without list_del_rcu() first. Unlink each op with list_del_rcu() before handing it to bcm_remove_op(), matching the existing pattern in bcm_delete_tx_op()/bcm_delete_rx_op().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72120
EUVD
EUVD-2026-58878

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves missing RCU (Read-Copy-Update) list annotations and operations in the CAN BCM (Broadcast Manager) module. Specifically, it requires adding list_add_rcu() calls in bcm_rx_setup() and bcm_tx_setup() to properly initialize bcm_op structures during traversal under rcu_read_lock(). The fix also ensures list_del_rcu() is called before freeing operations in bcm_release() to prevent use-after-free issues.

Detection Guidance

This vulnerability is specific to the Linux kernel's CAN BCM module and involves improper RCU list handling. Detection requires checking kernel logs for related errors or kernel crashes. Commands like dmesg | grep -i can or journalctl -k | grep -i can may help identify issues. Ensure your kernel version is updated to a patched release.

Impact Analysis

This vulnerability could lead to kernel memory corruption or crashes if exploited. Attackers might trigger race conditions during CAN BCM operations, causing system instability or denial of service. Systems using CAN BCM for networking or industrial control may be affected.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. Reboot the system after applying the update. If immediate patching is not possible, consider disabling the CAN BCM module via kernel module blacklisting until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72120. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart