CVE-2026-72125

Received Received - Intake

Use-After-Free in Linux Kernel CAN ISOTP

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER isotp_release() looked up the bound network device via dev_get_by_index() using the stored ifindex. During device unregistration the device is unlisted from the ifindex hash before the NETDEV_UNREGISTER notifier chain runs, so a concurrent isotp_release() could find no device, skip can_rx_unregister() entirely, and still proceed to free the socket. Since isotp_release() had already removed itself from the isotp notifier list at that point, isotp_notify() would never get a chance to clean up either, leaving a stale CAN filter that keeps pointing at the freed socket. Fix this the same way raw.c already does: hold a tracked reference to the bound net_device in the socket (so->dev/so->dev_tracker) from bind() onward instead of re-resolving it from the ifindex, and serialize bind()/release() with rtnl_lock() so that so->dev is always consistent with what the NETDEV_UNREGISTER notifier sees. so->dev stays valid regardless of ifindex-hash unlisting, and is only ever cleared by whichever of isotp_release()/isotp_notify() gets there first, so the filter is always removed exactly once. isotp_bind() now rejects a (re)bind with -EAGAIN while so->[tx|rx].state isn't ISOTP_IDLE yet, so a timer left running by a prior NETDEV_UNREGISTER can't act on a newly bound so->ifindex. Both checks share the same lock_sock() section, so there is no window in which a concurrent isotp_notify() clearing so->bound could be missed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72125

EUVD

EUVD-2026-58883

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	isotp	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a use-after-free race condition in the CAN isotp protocol. The issue occurs when the isotp_release() function tries to access a network device that has been unregistered concurrently. The device is removed from the ifindex hash before cleanup notifiers run, causing isotp_release() to skip proper cleanup and free the socket prematurely. This leaves a stale CAN filter pointing to freed memory.

Detection Guidance

This vulnerability affects the Linux kernel's CAN isotp module and may lead to use-after-free conditions. Detection requires checking kernel logs for CAN-related errors or crashes, particularly during network device unregistration. Commands like dmesg | grep isotp or journalctl -k | grep isotp may reveal issues. Ensure your kernel is updated to a patched version.

Impact Analysis

This vulnerability could lead to system crashes, memory corruption, or privilege escalation if exploited. Attackers might trigger the race condition to cause denial-of-service or execute arbitrary code in the kernel context.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a use-after-free race condition in the Linux kernel's CAN isotp protocol implementation. Compliance impacts would only occur if this vulnerability were exploited to cause system instability or unauthorized access, which is not described in the provided context.

Mitigation Strategies

Immediately update your Linux kernel to a version containing the fix for CVE-2026-72125. If updating is not possible, disable the isotp module by unloading the can-isotp kernel module (rmmod can-isotp) if not actively used. Monitor system logs for CAN-related errors post-update.

Hi! I’m here to help you understand CVE-2026-72125. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70