CVE-2026-72121

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72121", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.907Z", "datePublished": "2026-08-15T05:52:59.959Z", "dateUpdated": "2026-10-16T18:44:57.290Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:36:16.520Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: add locking when updating filter and timer values\n\nKCSAN detected a simultaneous access to timer values that can be\noverwritten in bcm_rx_setup() when updating timer and filter content\nwhile bcm_rx_handler(), bcm_rx_timeout_handler() or bcm_rx_thr_handler()\nrun concurrently on incoming CAN traffic.\n\nProtect the timer (ival1/ival2/kt_ival1/kt_ival2/kt_lastmsg) and filter\n(nframes/flags/frames/last_frames) updates in bcm_rx_setup() with a new\nper-op bcm_rx_update_lock, taken with the matching scope in the RX\nhandlers. memcpy_from_msg() is staged into a temporary buffer before the\nlock is taken, since it can sleep and must not run under a spinlock.\n\nhrtimer_cancel() is always called without bcm_rx_update_lock held, since\nbcm_rx_timeout_handler()/bcm_rx_thr_handler() take the same lock and a\nrunning callback would otherwise deadlock against the canceller.\n\nAlso close a related race: bcm_rx_setup() cleared the RTR flag in the\nstored reply frame's can_id as a separate, unprotected step after the\nframe content was already installed, so a concurrent bcm_rx_handler()\ncould transmit a stale reply with CAN_RTR_FLAG still set. Fold that\nnormalization into the initial frame preparation instead (on the staged\nbuffer for updates, directly on op->frames pre-registration for new\nops), so the installed frame is always atomically self-consistent.\n\nbcm_rx_handler()'s RX_RTR_FRAME check now takes a lock-protected\nsnapshot of op->flags before deciding whether to call bcm_can_tx(),\nbut does not hold the lock across that call.\n\nAlso take a lock-protected snapshot of the currframe in bcm_can_tx()\nto avoid partly overwrites by content updates in bcm_tx_setup().\nFinally check if a TX_RESET_MULTI_IDX/SETTIMER might have reset\nop->currframe between the two locked sections in bcm_can_tx().\n\nOmit calling hrtimer_forward() with zero interval in bcm_rx_thr_handler().\nkt_ival2 may have been concurrently cleared by bcm_rx_setup() before it\ncancels this timer, so check kt_ival2 inside the bcm_rx_update_lock."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The race is driven by concurrent CAN frame reception in bcm_rx_handler()/timer callbacks on a shared CAN segment (automotive OBD/ECU bus, factory controllers, CAN-USB adapters), an adjacent broadcast medium comparable to Bluetooth/WiFi segment access.\nAC:L - An attacker controls both race sides by flooding RX_SETUP via sendmsg while concurrently injecting matching CAN frames or armed timers; syzbot reliably reproduced the KCSAN race without timing conditions beyond attacker control.\nPR:N - CAN_BCM sockets impose no capability checks in can_create()/bcm_sendmsg(), and a bus participant can trigger the RX handler path without any Linux credentials while racing BCM configuration updates from local services.\nUI:N - Exploitation requires no victim interaction beyond normal background CAN/BCM activity on systems that already use the Broadcast Manager for monitoring or diagnostics.\nS:U - Impact is confined to kernel memory corruption and privilege boundaries within the same host; this is not a VM escape, IOMMU bypass, or cross-authority sandbox breakout.\nC:H - Unlocked concurrent updates to nframes/flags/frames/last_frames permit torn reads and out-of-bounds accesses in handler loops and timeout memset, matching the prior BCM race class that produced KASAN slab-out-of-bounds reads.\nI:H - Partial overwrites of op->frames during bcm_can_tx(), stale RTR replies transmitted on the bus, and size-mismatched memset/memcpy against concurrently shrinking buffers enable arbitrary CAN injection and kernel heap corruption.\nA:H - Concurrent timer corruption (hrtimer_forward with zero kt_ival2), torn structure fields, and heap corruption from racing memset/copy operations can cause kernel oops, panic, or sustained denial of service on CAN-equipped systems."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/can/bcm.c"], "versions": [{"version": "7595de7bc56e0e52b74e56c90f7e247bf626d628", "lessThan": "96994180bd7b248b0cc698afe926e23fc1bda59b", "status": "affected", "versionType": "git"}, {"version": "fbd8fdc2b218e979cfe422b139b8f74c12419d1f", "lessThan": "caa8704a7f3cb7806331596195385437126ecb3a", "status": "affected", "versionType": "git"}, {"version": "2a437b86ac5a9893c902f30ef66815bf13587bf6", "lessThan": "a7c369e7da8203e2b5be12bbcac7b9ab2ed5b658", "status": "affected", "versionType": "git"}, {"version": "76c84c3728178b2d38d5604e399dfe8b0752645e", "lessThan": "a7eb6db1cd3f7b556a301dc1265945ad112089f7", "status": "affected", "versionType": "git"}, {"version": "cc55dd28c20a6611e30596019b3b2f636819a4c0", "lessThan": "834cbca3b12e46887f7a9b35f1981a888360ea4c", "status": "affected", "versionType": "git"}, {"version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7", "lessThan": "19b1994069dd29478ba767de1f98f14a088198dc", "status": "affected", "versionType": "git"}, {"version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7", "lessThan": "fc9f5ee1b073bd233d9c604e338af4ebb42cbc33", "status": "affected", "versionType": "git"}, {"version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7", "lessThan": "749179c2e25b95d22499ed29096b3e02d6dfd2b4", "status": "affected", "versionType": "git"}, {"version": "8f1c022541bf5a923c8d6fa483112c15250f30a4", "status": "affected", "versionType": "git"}, {"version": "c4e8a172501e677ebd8ea9d9161d97dc4df56fbd", "status": "affected", "versionType": "git"}, {"version": "5.10.238", "lessThan": "5.10.265", "status": "affected", "versionType": "semver"}, {"version": "5.15.185", "lessThan": "5.15.216", "status": "affected", "versionType": "semver"}, {"version": "6.1.141", "lessThan": "6.1.183", "status": "affected", "versionType": "semver"}, {"version": "6.6.93", "lessThan": "6.6.148", "status": "affected", "versionType": "semver"}, {"version": "6.12.31", "lessThan": "6.12.101", "status": "affected", "versionType": "semver"}, {"version": "5.4.294", "lessThan": "5.5", "status": "affected", "versionType": "semver"}, {"version": "6.14.9", "lessThan": "6.15", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/can/bcm.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.238", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.185", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.141", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.93", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.31", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.294"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/96994180bd7b248b0cc698afe926e23fc1bda59b"}, {"url": "https://git.kernel.org/stable/c/caa8704a7f3cb7806331596195385437126ecb3a"}, {"url": "https://git.kernel.org/stable/c/a7c369e7da8203e2b5be12bbcac7b9ab2ed5b658"}, {"url": "https://git.kernel.org/stable/c/a7eb6db1cd3f7b556a301dc1265945ad112089f7"}, {"url": "https://git.kernel.org/stable/c/834cbca3b12e46887f7a9b35f1981a888360ea4c"}, {"url": "https://git.kernel.org/stable/c/19b1994069dd29478ba767de1f98f14a088198dc"}, {"url": "https://git.kernel.org/stable/c/fc9f5ee1b073bd233d9c604e338af4ebb42cbc33"}, {"url": "https://git.kernel.org/stable/c/749179c2e25b95d22499ed29096b3e02d6dfd2b4"}], "title": "can: bcm: add locking when updating filter and timer values", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72121", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:42:04.470904Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:44:57.290Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72121", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:42:04.470904Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:42:05.707Z"}}], "cna": {"title": "can: bcm: add locking when updating filter and timer values", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The race is driven by concurrent CAN frame reception in bcm_rx_handler()/timer callbacks on a shared CAN segment (automotive OBD/ECU bus, factory controllers, CAN-USB adapters), an adjacent broadcast medium comparable to Bluetooth/WiFi segment access.\nAC:L - An attacker controls both race sides by flooding RX_SETUP via sendmsg while concurrently injecting matching CAN frames or armed timers; syzbot reliably reproduced the KCSAN race without timing conditions beyond attacker control.\nPR:N - CAN_BCM sockets impose no capability checks in can_create()/bcm_sendmsg(), and a bus participant can trigger the RX handler path without any Linux credentials while racing BCM configuration updates from local services.\nUI:N - Exploitation requires no victim interaction beyond normal background CAN/BCM activity on systems that already use the Broadcast Manager for monitoring or diagnostics.\nS:U - Impact is confined to kernel memory corruption and privilege boundaries within the same host; this is not a VM escape, IOMMU bypass, or cross-authority sandbox breakout.\nC:H - Unlocked concurrent updates to nframes/flags/frames/last_frames permit torn reads and out-of-bounds accesses in handler loops and timeout memset, matching the prior BCM race class that produced KASAN slab-out-of-bounds reads.\nI:H - Partial overwrites of op->frames during bcm_can_tx(), stale RTR replies transmitted on the bus, and size-mismatched memset/memcpy against concurrently shrinking buffers enable arbitrary CAN injection and kernel heap corruption.\nA:H - Concurrent timer corruption (hrtimer_forward with zero kt_ival2), torn structure fields, and heap corruption from racing memset/copy operations can cause kernel oops, panic, or sustained denial of service on CAN-equipped systems."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7595de7bc56e0e52b74e56c90f7e247bf626d628", "lessThan": "96994180bd7b248b0cc698afe926e23fc1bda59b", "versionType": "git"}, {"status": "affected", "version": "fbd8fdc2b218e979cfe422b139b8f74c12419d1f", "lessThan": "caa8704a7f3cb7806331596195385437126ecb3a", "versionType": "git"}, {"status": "affected", "version": "2a437b86ac5a9893c902f30ef66815bf13587bf6", "lessThan": "a7c369e7da8203e2b5be12bbcac7b9ab2ed5b658", "versionType": "git"}, {"status": "affected", "version": "76c84c3728178b2d38d5604e399dfe8b0752645e", "lessThan": "a7eb6db1cd3f7b556a301dc1265945ad112089f7", "versionType": "git"}, {"status": "affected", "version": "cc55dd28c20a6611e30596019b3b2f636819a4c0", "lessThan": "834cbca3b12e46887f7a9b35f1981a888360ea4c", "versionType": "git"}, {"status": "affected", "version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7", "lessThan": "19b1994069dd29478ba767de1f98f14a088198dc", "versionType": "git"}, {"status": "affected", "version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7", "lessThan": "fc9f5ee1b073bd233d9c604e338af4ebb42cbc33", "versionType": "git"}, {"status": "affected", "version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7", "lessThan": "749179c2e25b95d22499ed29096b3e02d6dfd2b4", "versionType": "git"}, {"status": "affected", "version": "8f1c022541bf5a923c8d6fa483112c15250f30a4", "versionType": "git"}, {"status": "affected", "version": "c4e8a172501e677ebd8ea9d9161d97dc4df56fbd", "versionType": "git"}, {"status": "affected", "version": "5.10.238", "lessThan": "5.10.265", "versionType": "semver"}, {"status": "affected", "version": "5.15.185", "lessThan": "5.15.216", "versionType": "semver"}, {"status": "affected", "version": "6.1.141", "lessThan": "6.1.183", "versionType": "semver"}, {"status": "affected", "version": "6.6.93", "lessThan": "6.6.148", "versionType": "semver"}, {"status": "affected", "version": "6.12.31", "lessThan": "6.12.101", "versionType": "semver"}, {"status": "affected", "version": "5.4.294", "lessThan": "5.5", "versionType": "semver"}, {"status": "affected", "version": "6.14.9", "lessThan": "6.15", "versionType": "semver"}], "programFiles": ["net/can/bcm.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"status": "unaffected", "version": "0", "lessThan": "6.15", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.265", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.148", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.101", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.42", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/can/bcm.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/96994180bd7b248b0cc698afe926e23fc1bda59b"}, {"url": "https://git.kernel.org/stable/c/caa8704a7f3cb7806331596195385437126ecb3a"}, {"url": "https://git.kernel.org/stable/c/a7c369e7da8203e2b5be12bbcac7b9ab2ed5b658"}, {"url": "https://git.kernel.org/stable/c/a7eb6db1cd3f7b556a301dc1265945ad112089f7"}, {"url": "https://git.kernel.org/stable/c/834cbca3b12e46887f7a9b35f1981a888360ea4c"}, {"url": "https://git.kernel.org/stable/c/19b1994069dd29478ba767de1f98f14a088198dc"}, {"url": "https://git.kernel.org/stable/c/fc9f5ee1b073bd233d9c604e338af4ebb42cbc33"}, {"url": "https://git.kernel.org/stable/c/749179c2e25b95d22499ed29096b3e02d6dfd2b4"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: add locking when updating filter and timer values\n\nKCSAN detected a simultaneous access to timer values that can be\noverwritten in bcm_rx_setup() when updating timer and filter content\nwhile bcm_rx_handler(), bcm_rx_timeout_handler() or bcm_rx_thr_handler()\nrun concurrently on incoming CAN traffic.\n\nProtect the timer (ival1/ival2/kt_ival1/kt_ival2/kt_lastmsg) and filter\n(nframes/flags/frames/last_frames) updates in bcm_rx_setup() with a new\nper-op bcm_rx_update_lock, taken with the matching scope in the RX\nhandlers. memcpy_from_msg() is staged into a temporary buffer before the\nlock is taken, since it can sleep and must not run under a spinlock.\n\nhrtimer_cancel() is always called without bcm_rx_update_lock held, since\nbcm_rx_timeout_handler()/bcm_rx_thr_handler() take the same lock and a\nrunning callback would otherwise deadlock against the canceller.\n\nAlso close a related race: bcm_rx_setup() cleared the RTR flag in the\nstored reply frame's can_id as a separate, unprotected step after the\nframe content was already installed, so a concurrent bcm_rx_handler()\ncould transmit a stale reply with CAN_RTR_FLAG still set. Fold that\nnormalization into the initial frame preparation instead (on the staged\nbuffer for updates, directly on op->frames pre-registration for new\nops), so the installed frame is always atomically self-consistent.\n\nbcm_rx_handler()'s RX_RTR_FRAME check now takes a lock-protected\nsnapshot of op->flags before deciding whether to call bcm_can_tx(),\nbut does not hold the lock across that call.\n\nAlso take a lock-protected snapshot of the currframe in bcm_can_tx()\nto avoid partly overwrites by content updates in bcm_tx_setup().\nFinally check if a TX_RESET_MULTI_IDX/SETTIMER might have reset\nop->currframe between the two locked sections in bcm_can_tx().\n\nOmit calling hrtimer_forward() with zero interval in bcm_rx_thr_handler().\nkt_ival2 may have been concurrently cleared by bcm_rx_setup() before it\ncancels this timer, so check kt_ival2 inside the bcm_rx_update_lock."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.265", "versionStartIncluding": "5.10.238"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.216", "versionStartIncluding": "5.15.185"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "6.1.141"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.148", "versionStartIncluding": "6.6.93"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.101", "versionStartIncluding": "6.12.31"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.42", "versionStartIncluding": "6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.4.294"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.14.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:36:16.520Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72121", "state": "PUBLISHED", "dateUpdated": "2026-10-16T18:44:57.290Z", "dateReserved": "2026-08-09T03:40:39.907Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:52:59.959Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/can/bcm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "96994180bd7b248b0cc698afe926e23fc1bda59b", "status": "affected", "version": "7595de7bc56e0e52b74e56c90f7e247bf626d628", "versionType": "git"}, {"lessThan": "caa8704a7f3cb7806331596195385437126ecb3a", "status": "affected", "version": "fbd8fdc2b218e979cfe422b139b8f74c12419d1f", "versionType": "git"}, {"lessThan": "a7c369e7da8203e2b5be12bbcac7b9ab2ed5b658", "status": "affected", "version": "2a437b86ac5a9893c902f30ef66815bf13587bf6", "versionType": "git"}, {"lessThan": "a7eb6db1cd3f7b556a301dc1265945ad112089f7", "status": "affected", "version": "76c84c3728178b2d38d5604e399dfe8b0752645e", "versionType": "git"}, {"lessThan": "834cbca3b12e46887f7a9b35f1981a888360ea4c", "status": "affected", "version": "cc55dd28c20a6611e30596019b3b2f636819a4c0", "versionType": "git"}, {"lessThan": "19b1994069dd29478ba767de1f98f14a088198dc", "status": "affected", "version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7", "versionType": "git"}, {"lessThan": "fc9f5ee1b073bd233d9c604e338af4ebb42cbc33", "status": "affected", "version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7", "versionType": "git"}, {"lessThan": "749179c2e25b95d22499ed29096b3e02d6dfd2b4", "status": "affected", "version": "c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7", "versionType": "git"}, {"status": "affected", "version": "8f1c022541bf5a923c8d6fa483112c15250f30a4", "versionType": "git"}, {"status": "affected", "version": "c4e8a172501e677ebd8ea9d9161d97dc4df56fbd", "versionType": "git"}, {"lessThan": "5.10.265", "status": "affected", "version": "5.10.238", "versionType": "semver"}, {"lessThan": "5.15.216", "status": "affected", "version": "5.15.185", "versionType": "semver"}, {"lessThan": "6.1.183", "status": "affected", "version": "6.1.141", "versionType": "semver"}, {"lessThan": "6.6.148", "status": "affected", "version": "6.6.93", "versionType": "semver"}, {"lessThan": "6.12.101", "status": "affected", "version": "6.12.31", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.294", "versionType": "semver"}, {"lessThan": "6.15", "status": "affected", "version": "6.14.9", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/can/bcm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.148", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: add locking when updating filter and timer values\n\nKCSAN detected a simultaneous access to timer values that can be\noverwritten in bcm_rx_setup() when updating timer and filter content\nwhile bcm_rx_handler(), bcm_rx_timeout_handler() or bcm_rx_thr_handler()\nrun concurrently on incoming CAN traffic.\n\nProtect the timer (ival1/ival2/kt_ival1/kt_ival2/kt_lastmsg) and filter\n(nframes/flags/frames/last_frames) updates in bcm_rx_setup() with a new\nper-op bcm_rx_update_lock, taken with the matching scope in the RX\nhandlers. memcpy_from_msg() is staged into a temporary buffer before the\nlock is taken, since it can sleep and must not run under a spinlock.\n\nhrtimer_cancel() is always called without bcm_rx_update_lock held, since\nbcm_rx_timeout_handler()/bcm_rx_thr_handler() take the same lock and a\nrunning callback would otherwise deadlock against the canceller.\n\nAlso close a related race: bcm_rx_setup() cleared the RTR flag in the\nstored reply frame's can_id as a separate, unprotected step after the\nframe content was already installed, so a concurrent bcm_rx_handler()\ncould transmit a stale reply with CAN_RTR_FLAG still set. Fold that\nnormalization into the initial frame preparation instead (on the staged\nbuffer for updates, directly on op->frames pre-registration for new\nops), so the installed frame is always atomically self-consistent.\n\nbcm_rx_handler()'s RX_RTR_FRAME check now takes a lock-protected\nsnapshot of op->flags before deciding whether to call bcm_can_tx(),\nbut does not hold the lock across that call.\n\nAlso take a lock-protected snapshot of the currframe in bcm_can_tx()\nto avoid partly overwrites by content updates in bcm_tx_setup().\nFinally check if a TX_RESET_MULTI_IDX/SETTIMER might have reset\nop->currframe between the two locked sections in bcm_can_tx().\n\nOmit calling hrtimer_forward() with zero interval in bcm_rx_thr_handler().\nkt_ival2 may have been concurrently cleared by bcm_rx_setup() before it\ncancels this timer, so check kt_ival2 inside the bcm_rx_update_lock."}], "id": "CVE-2026-72121", "lastModified": "2026-10-16T19:17:09.797", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72121", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:42:04.470904Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:21:26.650", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/19b1994069dd29478ba767de1f98f14a088198dc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/749179c2e25b95d22499ed29096b3e02d6dfd2b4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/834cbca3b12e46887f7a9b35f1981a888360ea4c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/96994180bd7b248b0cc698afe926e23fc1bda59b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a7c369e7da8203e2b5be12bbcac7b9ab2ed5b658"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a7eb6db1cd3f7b556a301dc1265945ad112089f7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/caa8704a7f3cb7806331596195385437126ecb3a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fc9f5ee1b073bd233d9c604e338af4ebb42cbc33"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: can: bcm: add locking when updating filter and timer values", "id": "2516398", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516398"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in the Linux kernel's Controller Area Network (CAN) Broadcom (bcm) driver. A race condition exists when the driver attempts to update filter and timer values simultaneously with ongoing receive operations. This can lead to the transmission of stale CAN reply frames with an incorrect Remote Transmission Request (RTR) flag set, potentially causing incorrect communication or unexpected behavior on the CAN bus."], "name": "CVE-2026-72121", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72121\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72121\nhttps://lore.kernel.org/linux-cve-announce/2026081528-CVE-2026-72121-9a44@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[76c84c3728178b2d38d5604e399dfe8b0752645e,a7eb6db1cd3f7b556a301dc1265945ad112089f7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cc55dd28c20a6611e30596019b3b2f636819a4c0,834cbca3b12e46887f7a9b35f1981a888360ea4c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7,19b1994069dd29478ba767de1f98f14a088198dc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7,fc9f5ee1b073bd233d9c604e338af4ebb42cbc33)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7,749179c2e25b95d22499ed29096b3e02d6dfd2b4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8f1c022541bf5a923c8d6fa483112c15250f30a4,8f1c022541bf5a923c8d6fa483112c15250f30a4]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7595de7bc56e0e52b74e56c90f7e247bf626d628,7595de7bc56e0e52b74e56c90f7e247bf626d628]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fbd8fdc2b218e979cfe422b139b8f74c12419d1f,fbd8fdc2b218e979cfe422b139b8f74c12419d1f]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2a437b86ac5a9893c902f30ef66815bf13587bf6,2a437b86ac5a9893c902f30ef66815bf13587bf6]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c4e8a172501e677ebd8ea9d9161d97dc4df56fbd,c4e8a172501e677ebd8ea9d9161d97dc4df56fbd]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.93,6.6.148)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.31,6.12.101)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.4.294,5.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.10.238,5.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.15.185,5.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.141,6.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.14.9,6.15)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.15,6.15]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.148,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.101,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.42,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1.5,7.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T13:00:05.413996+00:00", "updated": "2026-08-18T04:45:04.399105+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}