CVE-2026-72121

CVE CVE-2026-72121EUVD EUVD-2026-58879Published 2026-08-15T05:52:59.000ZLast changed 2026-08-19T16:36:16.000ZCVSS 8.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and timer values KCSAN detected a simultaneous access to timer values that can be overwritten in bcm_rx_setup() when updating timer and filter content while bcm_rx_handler(), bcm_rx_timeout_handler() or bcm_rx_thr_handler() run concurrently on incoming CAN traffic. Protect the timer (ival1/ival2/kt_ival1/kt_ival2/kt_lastmsg) and filter (nframes/flags/frames/last_frames) updates in bcm_rx_setup() with a new per-op bcm_rx_update_lock, taken with the matching scope in the RX handlers. memcpy_from_msg() is staged into a temporary buffer before the lock is taken, since it can sleep and must not run under a spinlock. hrtimer_cancel() is always called without bcm_rx_update_lock held, since bcm_rx_timeout_handler()/bcm_rx_thr_handler() take the same lock and a running callback would otherwise deadlock against the canceller. Also close a related race: bcm_rx_setup() cleared the RTR flag in the stored reply frame's can_id as a separate, unprotected step after the frame content was already installed, so a concurrent bcm_rx_handler() could transmit a stale reply with CAN_RTR_FLAG still set. Fold that normalization into the initial frame preparation instead (on the staged buffer for updates, directly on op->frames pre-registration for new ops), so the installed frame is always atomically self-consistent. bcm_rx_handler()'s RX_RTR_FRAME check now takes a lock-protected snapshot of op->flags before deciding whether to call bcm_can_tx(), but does not hold the lock across that call. Also take a lock-protected snapshot of the currframe in bcm_can_tx() to avoid partly overwrites by content updates in bcm_tx_setup(). Finally check if a TX_RESET_MULTI_IDX/SETTIMER might have reset op->currframe between the two locked sections in bcm_can_tx(). Omit calling hrtimer_forward() with zero interval in bcm_rx_thr_handler(). kt_ival2 may have been concurrently cleared by bcm_rx_setup() before it cancels this timer, so check kt_ival2 inside the bcm_rx_update_lock.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 6.14.9 <6.15; cc55dd28c20a6611e30596019b3b2f636819a4c0 <834cbca3b12e46887f7a9b35f1981a888360ea4c; patch: 6.18.42; patch: 5.10.265; patch: 6.6.148; c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 <19b1994069dd29478ba767de1f98f14a088198dc; 6.15; 6.12.31 <6.12.101; 76c84c3728178b2d38d5604e399dfe8b0752645e <a7eb6db1cd3f7b556a301dc1265945ad112089f7; 8f1c022541bf5a923c8d6fa483112c15250f30a4; 5.4.294 <5.5; fbd8fdc2b218e979cfe422b139b8f74c12419d1f <caa8704a7f3cb7806331596195385437126ecb3a; patch: 6.1.183; patch: 6.12.101; 5.15.185 <5.15.216; 5.10.238 <5.10.265; 2a437b86ac5a9893c902f30ef66815bf13587bf6 <a7c369e7da8203e2b5be12bbcac7b9ab2ed5b658; 7595de7bc56e0e52b74e56c90f7e247bf626d628 <96994180bd7b248b0cc698afe926e23fc1bda59b; patch: 0; patch: 7.2; c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 <749179c2e25b95d22499ed29096b3e02d6dfd2b4; c4e8a172501e677ebd8ea9d9161d97dc4df56fbd; patch: 5.15.216; c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 <fc9f5ee1b073bd233d9c604e338af4ebb42cbc33; 6.1.141 <6.1.183; 6.6.93 <6.6.148; patch: 7.1.5

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.