CVE-2026-72113

CVE CVE-2026-72113EUVD EUVD-2026-59071Published 2026-08-15T05:52:54.000ZLast changed 2026-08-19T16:35:58.000ZCVSS 7.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing device refcount for CAN filter removal sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is present in the bcm.c code. A former fix for raw.c commit c275a176e4b6 ("can: raw: add missing refcount for memory leak fix") introduced a netdevice_tracker which solves the issue for bcm.c too. bcm_release(), bcm_delete_rx_op() and bcm_notifier() relied on dev_get_by_index(ifindex) to re-find the device for an rx_op before unregistering its filter. If a concurrent NETDEV_UNREGISTER has already unlisted the device from the ifindex table, that lookup fails and can_rx_unregister() is silently skipped, leaving a stale CAN filter pointing at the soon-to-be-freed bcm_op/socket. Hold a netdev_hold()/netdev_put() tracked reference on op->rx_reg_dev from the moment the rx filter is registered in bcm_rx_setup() until it is unregistered in bcm_rx_unreg(), and use that reference directly in bcm_release() and bcm_delete_rx_op() instead of re-looking the device up by ifindex.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux patch: 7.1.5; patch: 5.10.265; ffd980f976e7fd666c2e61bf8ab35107efd11828 <bd5232663524e94cc5aad861dca11e3db8e2ab6f; ffd980f976e7fd666c2e61bf8ab35107efd11828 <633bda66fbf309f5de5e1ad6defe8e6b1d77a20f; patch: 6.1.183; patch: 6.6.148; ffd980f976e7fd666c2e61bf8ab35107efd11828 <04d23061bbf18d5d81022eb21e9d32e99d24468d; ffd980f976e7fd666c2e61bf8ab35107efd11828 <dcaee869913c7210cd47ed0a8f27349d7bdcdb7b; ffd980f976e7fd666c2e61bf8ab35107efd11828 <ee8b36d0faca08f35b889b6e9aa850695e5b8ba9; patch: 6.18.42; patch: 0; 2.6.25; ffd980f976e7fd666c2e61bf8ab35107efd11828 <d59948293ea34b6337ce2b5febab8510de70048c; patch: 6.12.101; ffd980f976e7fd666c2e61bf8ab35107efd11828 <b024c21c9066f6957b7d4a8f2037e4b000c5e041; patch: 7.2; patch: 5.15.216; ffd980f976e7fd666c2e61bf8ab35107efd11828 <84aa4807816e405c1bf87114fc63e06d244281ef

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.