CVE-2026-72122
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure bcm_sendmsg() reads bo->ifindex and checks bo->bound before taking lock_sock(), while bcm_notify(), bcm_connect() and bcm_release() all mutate both fields under that same lock. Because the lockless reads and the locked writes are unordered with respect to each other, a racing bcm_notify() (device unregister) or bcm_connect() (concurrent bind on another thread sharing the socket) can make bcm_sendmsg() observe an inconsistent combination, e.g. a stale bound=1 together with the now-cleared ifindex=0, silently turning a socket bound to a specific CAN interface into one that also matches "any" interface. Keep the lockless bo->bound check purely as a fast-path reject, and move the ifindex read (and a bo->bound re-check) into the locked section, where every writer already serializes. This removes the possibility of observing the two fields torn against each other, rather than trying to fix it with more READ_ONCE()/WRITE_ONCE() pairs on two independently updated fields. Annotate the now-purely-lockless bo->bound accesses consistently across all its write sites. Also fix bcm_rx_setup() silently returning success when the target device disappears concurrently instead of reporting -ENODEV, so a broken RX op is no longer left registered as if it had succeeded.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72122
EUVD
EUVD-2026-58880

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the CAN BCM protocol implementation. It occurs when the bound state and interface index of a socket are read without proper locking, allowing a race between operations like device unregister or socket binding. This can lead to inconsistent socket states, where a socket bound to a specific CAN interface may incorrectly match any interface.

Detection Guidance

This vulnerability is specific to the Linux kernel's CAN BCM protocol implementation. Detection requires checking if your system is running a vulnerable kernel version. Use uname -a to check the kernel version and compare it against patched versions. Monitor CAN interface logs for unexpected behavior or failures in BCM socket operations.

Impact Analysis

This vulnerability could allow unintended CAN message reception on a socket, potentially leading to data leaks or unauthorized access to CAN bus communications. It may cause applications to receive messages they should not, disrupting normal operations or enabling malicious activities on the CAN network.

Mitigation Strategies

Update the Linux kernel to a version that includes the fix for CVE-2026-72122. If immediate patching is not possible, restrict access to CAN BCM sockets or disable unused CAN interfaces to reduce exposure. Monitor kernel security advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72122. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart