CVE-2026-72126
Received Received - Intake

Race Condition in Linux Kernel CAN ISOTP Socket Handling

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: can: isotp: use unconditional synchronize_rcu() in isotp_release() isotp_notify() unregisters the (RCU) CAN filters via can_rx_unregister() and clears so->bound without waiting for a grace period. isotp_release() uses so->bound to decide whether it needs to call synchronize_rcu() before cancelling so->rxtimer, so when NETDEV_UNREGISTER runs first it skips that synchronize_rcu() and can cancel the timer while an in-flight isotp_rcv() is still executing and about to re-arm it via isotp_send_fc(), leading to a use-after-free timer callback on the freed socket. sakisho-bot remarked a problem with rtnl_lock held in isotp_notify(), therefore make isotp_release() always call synchronize_rcu() before cancelling the timers, regardless of so->bound. This still closes the original race (isotp_notify() clearing so->bound without waiting for in-flight isotp_rcv() callers before isotp_release() cancels the RX timer) without adding any RCU wait to the netdevice notifier path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72126
EUVD
EUVD-2026-58884

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel isotp *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's CAN isotp protocol implementation. It occurs when the isotp_release() function cancels a timer without properly waiting for in-flight operations to complete, leading to a timer callback executing on freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's CAN isotp module and requires kernel-level inspection. Detection involves checking kernel logs for use-after-free errors in CAN isotp operations or monitoring for crashes in CAN-related processes. Commands like dmesg | grep isotp or journalctl -k | grep isotp may help identify issues.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service condition or potentially execute arbitrary code with kernel privileges by triggering the use-after-free condition through network operations.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch the isotp module. If immediate patching is not possible, consider disabling the CAN isotp module via rmmod isotp or blacklisting it until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72126. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart