CVE-2026-72125
Received Received - Intake

Use-After-Free in Linux Kernel CAN ISOTP

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER isotp_release() looked up the bound network device via dev_get_by_index() using the stored ifindex. During device unregistration the device is unlisted from the ifindex hash before the NETDEV_UNREGISTER notifier chain runs, so a concurrent isotp_release() could find no device, skip can_rx_unregister() entirely, and still proceed to free the socket. Since isotp_release() had already removed itself from the isotp notifier list at that point, isotp_notify() would never get a chance to clean up either, leaving a stale CAN filter that keeps pointing at the freed socket. Fix this the same way raw.c already does: hold a tracked reference to the bound net_device in the socket (so->dev/so->dev_tracker) from bind() onward instead of re-resolving it from the ifindex, and serialize bind()/release() with rtnl_lock() so that so->dev is always consistent with what the NETDEV_UNREGISTER notifier sees. so->dev stays valid regardless of ifindex-hash unlisting, and is only ever cleared by whichever of isotp_release()/isotp_notify() gets there first, so the filter is always removed exactly once. isotp_bind() now rejects a (re)bind with -EAGAIN while so->[tx|rx].state isn't ISOTP_IDLE yet, so a timer left running by a prior NETDEV_UNREGISTER can't act on a newly bound so->ifindex. Both checks share the same lock_sock() section, so there is no window in which a concurrent isotp_notify() clearing so->bound could be missed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72125
EUVD
EUVD-2026-58883

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a use-after-free race condition in the CAN isotp protocol. The issue occurs when the isotp_release() function tries to access a network device that has been unregistered concurrently. The device is removed from the ifindex hash before cleanup notifiers run, causing isotp_release() to skip proper cleanup and free the socket prematurely. This leaves a stale CAN filter pointing to freed memory.

Detection Guidance

This vulnerability affects the Linux kernel's CAN isotp module and may lead to use-after-free conditions. Detection requires checking kernel logs for CAN-related errors or crashes, particularly during network device unregistration. Commands like dmesg | grep isotp or journalctl -k | grep isotp may reveal issues. Ensure your kernel is updated to a patched version.

Impact Analysis

This vulnerability could lead to system crashes, memory corruption, or privilege escalation if exploited. Attackers might trigger the race condition to cause denial-of-service or execute arbitrary code in the kernel context.

Mitigation Strategies

Immediately update your Linux kernel to a version containing the fix for CVE-2026-72125. If updating is not possible, disable the isotp module by unloading the can-isotp kernel module (rmmod can-isotp) if not actively used. Monitor system logs for CAN-related errors post-update.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72125. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart