CVE-2026-72122

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72122", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.907Z", "datePublished": "2026-08-15T05:53:00.704Z", "dateUpdated": "2026-10-16T18:44:57.450Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:40:35.588Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure\n\nbcm_sendmsg() reads bo->ifindex and checks bo->bound before taking\nlock_sock(), while bcm_notify(), bcm_connect() and bcm_release() all\nmutate both fields under that same lock. Because the lockless reads\nand the locked writes are unordered with respect to each other, a\nracing bcm_notify() (device unregister) or bcm_connect() (concurrent\nbind on another thread sharing the socket) can make bcm_sendmsg()\nobserve an inconsistent combination, e.g. a stale bound=1 together\nwith the now-cleared ifindex=0, silently turning a socket bound to a\nspecific CAN interface into one that also matches \"any\" interface.\n\nKeep the lockless bo->bound check purely as a fast-path reject, and\nmove the ifindex read (and a bo->bound re-check) into the locked\nsection, where every writer already serializes. This removes the\npossibility of observing the two fields torn against each other,\nrather than trying to fix it with more READ_ONCE()/WRITE_ONCE() pairs\non two independently updated fields. Annotate the now-purely-lockless\nbo->bound accesses consistently across all its write sites.\n\nAlso fix bcm_rx_setup() silently returning success when the target\ndevice disappears concurrently instead of reporting -ENODEV, so a\nbroken RX op is no longer left registered as if it had succeeded."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "baseScore": 7.3, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local access to a PF_CAN SOCK_DGRAM CAN_BCM socket via sendmsg()/connect() syscalls; the race is in kernel socket state handling, not in remote packet reception or the physical CAN bus itself.\nAC:L - The attacker controls both sides of the race by concurrently calling sendmsg() on one thread while triggering bcm_connect() or NETDEV_UNREGISTER (e.g. ip link del) on another, making the torn bound/ifindex observation reliably triggerable.\nPR:L - No real-root capability is required beyond opening BCM sockets and binding to a CAN interface; unprivileged users with CAN access or CAP_NET_ADMIN via user namespaces can create vcan devices and drive the unregister/connect race.\nUI:N - Exploitation is fully attacker-driven through concurrent syscalls and does not require any victim user action such as mounting filesystems or opening files.\nS:U - The impact is unauthorized access to additional CAN interfaces within the same kernel security domain, not a cross-boundary escape such as VM breakout, sandbox escape, or IOMMU bypass.\nC:H - Racing to observe bound=1 with ifindex=0 causes RX_SETUP to register can_rx_register() on all CAN devices, letting a socket bound to one interface sniff traffic from every other CAN bus on the system including safety-critical vehicle or industrial networks.\nI:H - The same torn state enables TX_SETUP/TX_SEND on arbitrary interfaces via msg_name when per-socket binding would normally block it, allowing injection of attacker-controlled CAN frames onto buses the process was not authorized to transmit on.\nA:L - The concurrent bcm_rx_setup() bug can silently return success without registering a filter when the target device vanishes, degrading CAN monitoring reliability without causing kernel panic, oops, or deadlock."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/can/bcm.c"], "versions": [{"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "9e60c586faeaed80d55ab8ce2a4b8e56133bc395", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "ffa80a2af27c97453861a5128e537214a31cd18a", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "6bcc5cd247c2934373bc2a1cdf8bf12321169543", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "0f6f9f95294b4cbb26ba02209e893e3bd91237c3", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "b70f1a15533afeeec5d07f20bec3f3867ab1c7b6", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "35f0ac19efb1a3f6c5e12c00e475a9ec2d9c3a6d", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "b9c6ac6fb4e01b34575816066e5d3890a57b3c86", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "d9b091d9d22fee81ec53fb55d2032951993ceadb", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/can/bcm.c"], "versions": [{"version": "2.6.25", "status": "affected"}, {"version": "0", "lessThan": "2.6.25", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9e60c586faeaed80d55ab8ce2a4b8e56133bc395"}, {"url": "https://git.kernel.org/stable/c/ffa80a2af27c97453861a5128e537214a31cd18a"}, {"url": "https://git.kernel.org/stable/c/6bcc5cd247c2934373bc2a1cdf8bf12321169543"}, {"url": "https://git.kernel.org/stable/c/0f6f9f95294b4cbb26ba02209e893e3bd91237c3"}, {"url": "https://git.kernel.org/stable/c/b70f1a15533afeeec5d07f20bec3f3867ab1c7b6"}, {"url": "https://git.kernel.org/stable/c/35f0ac19efb1a3f6c5e12c00e475a9ec2d9c3a6d"}, {"url": "https://git.kernel.org/stable/c/b9c6ac6fb4e01b34575816066e5d3890a57b3c86"}, {"url": "https://git.kernel.org/stable/c/d9b091d9d22fee81ec53fb55d2032951993ceadb"}], "title": "can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72122", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:42:08.458786Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:44:57.450Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72122", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:42:08.458786Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:42:09.623Z"}}], "cna": {"title": "can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local access to a PF_CAN SOCK_DGRAM CAN_BCM socket via sendmsg()/connect() syscalls; the race is in kernel socket state handling, not in remote packet reception or the physical CAN bus itself.\nAC:L - The attacker controls both sides of the race by concurrently calling sendmsg() on one thread while triggering bcm_connect() or NETDEV_UNREGISTER (e.g. ip link del) on another, making the torn bound/ifindex observation reliably triggerable.\nPR:L - No real-root capability is required beyond opening BCM sockets and binding to a CAN interface; unprivileged users with CAN access or CAP_NET_ADMIN via user namespaces can create vcan devices and drive the unregister/connect race.\nUI:N - Exploitation is fully attacker-driven through concurrent syscalls and does not require any victim user action such as mounting filesystems or opening files.\nS:U - The impact is unauthorized access to additional CAN interfaces within the same kernel security domain, not a cross-boundary escape such as VM breakout, sandbox escape, or IOMMU bypass.\nC:H - Racing to observe bound=1 with ifindex=0 causes RX_SETUP to register can_rx_register() on all CAN devices, letting a socket bound to one interface sniff traffic from every other CAN bus on the system including safety-critical vehicle or industrial networks.\nI:H - The same torn state enables TX_SETUP/TX_SEND on arbitrary interfaces via msg_name when per-socket binding would normally block it, allowing injection of attacker-controlled CAN frames onto buses the process was not authorized to transmit on.\nA:L - The concurrent bcm_rx_setup() bug can silently return success without registering a filter when the target device vanishes, degrading CAN monitoring reliability without causing kernel panic, oops, or deadlock."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "9e60c586faeaed80d55ab8ce2a4b8e56133bc395", "versionType": "git"}, {"status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "ffa80a2af27c97453861a5128e537214a31cd18a", "versionType": "git"}, {"status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "6bcc5cd247c2934373bc2a1cdf8bf12321169543", "versionType": "git"}, {"status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "0f6f9f95294b4cbb26ba02209e893e3bd91237c3", "versionType": "git"}, {"status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "b70f1a15533afeeec5d07f20bec3f3867ab1c7b6", "versionType": "git"}, {"status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "35f0ac19efb1a3f6c5e12c00e475a9ec2d9c3a6d", "versionType": "git"}, {"status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "b9c6ac6fb4e01b34575816066e5d3890a57b3c86", "versionType": "git"}, {"status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "d9b091d9d22fee81ec53fb55d2032951993ceadb", "versionType": "git"}], "programFiles": ["net/can/bcm.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.25"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.25", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.261", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.212", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/can/bcm.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/9e60c586faeaed80d55ab8ce2a4b8e56133bc395"}, {"url": "https://git.kernel.org/stable/c/ffa80a2af27c97453861a5128e537214a31cd18a"}, {"url": "https://git.kernel.org/stable/c/6bcc5cd247c2934373bc2a1cdf8bf12321169543"}, {"url": "https://git.kernel.org/stable/c/0f6f9f95294b4cbb26ba02209e893e3bd91237c3"}, {"url": "https://git.kernel.org/stable/c/b70f1a15533afeeec5d07f20bec3f3867ab1c7b6"}, {"url": "https://git.kernel.org/stable/c/35f0ac19efb1a3f6c5e12c00e475a9ec2d9c3a6d"}, {"url": "https://git.kernel.org/stable/c/b9c6ac6fb4e01b34575816066e5d3890a57b3c86"}, {"url": "https://git.kernel.org/stable/c/d9b091d9d22fee81ec53fb55d2032951993ceadb"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure\n\nbcm_sendmsg() reads bo->ifindex and checks bo->bound before taking\nlock_sock(), while bcm_notify(), bcm_connect() and bcm_release() all\nmutate both fields under that same lock. Because the lockless reads\nand the locked writes are unordered with respect to each other, a\nracing bcm_notify() (device unregister) or bcm_connect() (concurrent\nbind on another thread sharing the socket) can make bcm_sendmsg()\nobserve an inconsistent combination, e.g. a stale bound=1 together\nwith the now-cleared ifindex=0, silently turning a socket bound to a\nspecific CAN interface into one that also matches \"any\" interface.\n\nKeep the lockless bo->bound check purely as a fast-path reject, and\nmove the ifindex read (and a bo->bound re-check) into the locked\nsection, where every writer already serializes. This removes the\npossibility of observing the two fields torn against each other,\nrather than trying to fix it with more READ_ONCE()/WRITE_ONCE() pairs\non two independently updated fields. Annotate the now-purely-lockless\nbo->bound accesses consistently across all its write sites.\n\nAlso fix bcm_rx_setup() silently returning success when the target\ndevice disappears concurrently instead of reporting -ENODEV, so a\nbroken RX op is no longer left registered as if it had succeeded."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.261", "versionStartIncluding": "2.6.25"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.212", "versionStartIncluding": "2.6.25"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.178", "versionStartIncluding": "2.6.25"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.145", "versionStartIncluding": "2.6.25"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.97", "versionStartIncluding": "2.6.25"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.40", "versionStartIncluding": "2.6.25"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "2.6.25"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "2.6.25"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:40:35.588Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72122", "state": "PUBLISHED", "dateUpdated": "2026-10-16T18:44:57.450Z", "dateReserved": "2026-08-09T03:40:39.907Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:53:00.704Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/can/bcm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9e60c586faeaed80d55ab8ce2a4b8e56133bc395", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "ffa80a2af27c97453861a5128e537214a31cd18a", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "6bcc5cd247c2934373bc2a1cdf8bf12321169543", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "0f6f9f95294b4cbb26ba02209e893e3bd91237c3", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "b70f1a15533afeeec5d07f20bec3f3867ab1c7b6", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "35f0ac19efb1a3f6c5e12c00e475a9ec2d9c3a6d", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "b9c6ac6fb4e01b34575816066e5d3890a57b3c86", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "d9b091d9d22fee81ec53fb55d2032951993ceadb", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/can/bcm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.25"}, {"lessThan": "2.6.25", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure\n\nbcm_sendmsg() reads bo->ifindex and checks bo->bound before taking\nlock_sock(), while bcm_notify(), bcm_connect() and bcm_release() all\nmutate both fields under that same lock. Because the lockless reads\nand the locked writes are unordered with respect to each other, a\nracing bcm_notify() (device unregister) or bcm_connect() (concurrent\nbind on another thread sharing the socket) can make bcm_sendmsg()\nobserve an inconsistent combination, e.g. a stale bound=1 together\nwith the now-cleared ifindex=0, silently turning a socket bound to a\nspecific CAN interface into one that also matches \"any\" interface.\n\nKeep the lockless bo->bound check purely as a fast-path reject, and\nmove the ifindex read (and a bo->bound re-check) into the locked\nsection, where every writer already serializes. This removes the\npossibility of observing the two fields torn against each other,\nrather than trying to fix it with more READ_ONCE()/WRITE_ONCE() pairs\non two independently updated fields. Annotate the now-purely-lockless\nbo->bound accesses consistently across all its write sites.\n\nAlso fix bcm_rx_setup() silently returning success when the target\ndevice disappears concurrently instead of reporting -ENODEV, so a\nbroken RX op is no longer left registered as if it had succeeded."}], "id": "CVE-2026-72122", "lastModified": "2026-10-16T19:17:09.990", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.5, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72122", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:42:08.458786Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:21:29.437", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0f6f9f95294b4cbb26ba02209e893e3bd91237c3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/35f0ac19efb1a3f6c5e12c00e475a9ec2d9c3a6d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6bcc5cd247c2934373bc2a1cdf8bf12321169543"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9e60c586faeaed80d55ab8ce2a4b8e56133bc395"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b70f1a15533afeeec5d07f20bec3f3867ab1c7b6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b9c6ac6fb4e01b34575816066e5d3890a57b3c86"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d9b091d9d22fee81ec53fb55d2032951993ceadb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ffa80a2af27c97453861a5128e537214a31cd18a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure", "id": "2516641", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516641"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in the CAN BCM (Controller Area Network Broadcast Manager) module of the Linux kernel. A race condition exists where a socket intended for a specific CAN interface can silently be reconfigured to receive messages from any interface. This occurs due to inconsistent reads of socket binding parameters while other operations are modifying them. This could lead to unintended information disclosure or bypass of network segmentation. Additionally, a related issue allows `bcm_rx_setup()` to silently report success even if the target device is unavailable, potentially leading to a denial of service for receive operations."], "name": "CVE-2026-72122", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72122\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72122\nhttps://lore.kernel.org/linux-cve-announce/2026081528-CVE-2026-72122-b990@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ffd980f976e7fd666c2e61bf8ab35107efd11828,9e60c586faeaed80d55ab8ce2a4b8e56133bc395)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ffd980f976e7fd666c2e61bf8ab35107efd11828,ffa80a2af27c97453861a5128e537214a31cd18a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ffd980f976e7fd666c2e61bf8ab35107efd11828,6bcc5cd247c2934373bc2a1cdf8bf12321169543)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ffd980f976e7fd666c2e61bf8ab35107efd11828,0f6f9f95294b4cbb26ba02209e893e3bd91237c3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ffd980f976e7fd666c2e61bf8ab35107efd11828,b70f1a15533afeeec5d07f20bec3f3867ab1c7b6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ffd980f976e7fd666c2e61bf8ab35107efd11828,35f0ac19efb1a3f6c5e12c00e475a9ec2d9c3a6d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ffd980f976e7fd666c2e61bf8ab35107efd11828,b9c6ac6fb4e01b34575816066e5d3890a57b3c86)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ffd980f976e7fd666c2e61bf8ab35107efd11828,d9b091d9d22fee81ec53fb55d2032951993ceadb)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.25"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,2.6.25)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.261,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.212,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T13:45:03.064852+00:00", "updated": "2026-08-18T04:45:04.398486+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}