CVE-2026-72123

Received Received - Intake

Use-After-Free in Linux Kernel CAN BCM Module

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF Commit f1b4e32aca08 ("can: bcm: use call_rcu() instead of costly synchronize_rcu()") replaced synchronize_rcu() in bcm_delete_rx_op() with call_rcu() and introduced the RX_NO_AUTOTIMER flag. However, this flag check was omitted for thrtimer in the packet rx fast-path. During BCM RX operation teardown, a concurrent RCU reader (bcm_rx_handler) can race and re-arm thrtimer via bcm_rx_update_and_send() after call_rcu() has been scheduled. Once the RCU grace period elapses, bcm_op is freed. The subsequently firing thrtimer then dereferences the deallocated op, causing a UAF. Adding flag checks to the rx fast-path (bcm_rx_update_and_send) does not fully close the TOCTOU race and introduces latency for every CAN frame. Conversely, calling hrtimer_cancel() directly inside the RCU callback (softirq context) is fatal as hrtimer_cancel() can sleep, triggering a "scheduling while atomic" panic. Resolve this by deferring the timer cancellation and memory free to a dedicated unbound workqueue (bcm_wq). The RCU callback now queues a work item to bcm_wq, which safely cancels both timers and deallocates memory in sleepable process context. A dedicated workqueue is used to prevent system-wide WQ saturation and is cleanly flushed/destroyed on module unload to avoid rmmod page faults. Since the deferred work can now outlive the calling context by an unbounded amount, also take a reference on op->sk when it is assigned and drop it only once the deferred work has cancelled both timers, so a socket can no longer be freed out from under a still-armed timer whose callback (bcm_send_to_user()) dereferences op->sk.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72123

EUVD

EUVD-2026-58881

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's CAN BCM protocol implementation. It occurs when a timer (thrtimer) is re-armed by a concurrent operation after memory has been freed, leading to a race condition where the timer dereferences deallocated memory. The issue stems from improper handling of timer cancellation and memory deallocation during BCM RX operation teardown.

Detection Guidance

This vulnerability is specific to the Linux kernel's CAN BCM module and requires kernel-level detection. There are no standard network commands to detect it directly. You should check your kernel version against the patched version and monitor for kernel crashes or UAF-related errors in system logs.

Impact Analysis

This vulnerability could allow an attacker with local access to trigger a kernel crash or execute arbitrary code with kernel privileges, potentially leading to system compromise. It may also cause denial-of-service conditions by destabilizing the kernel.

Compliance Impact

This vulnerability is a use-after-free (UAF) issue in the Linux kernel's CAN BCM protocol implementation. It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel memory safety issues.

Mitigation Strategies

Apply the kernel patch that resolves this issue. If patching is not immediately possible, consider disabling the CAN BCM module if it is not required. Monitor for crashes or UAF errors in kernel logs as potential indicators of exploitation.

Hi! I’m here to help you understand CVE-2026-72123. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70