CVE-2026-72121 - Vulnerability Details

- can: bcm: add locking when updating filter and timer values

Description

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: add locking when updating filter and timer values

KCSAN detected a simultaneous access to timer values that can be
overwritten in bcm_rx_setup() when updating timer and filter content
while bcm_rx_handler(), bcm_rx_timeout_handler() or bcm_rx_thr_handler()
run concurrently on incoming CAN traffic.

Protect the timer (ival1/ival2/kt_ival1/kt_ival2/kt_lastmsg) and filter
(nframes/flags/frames/last_frames) updates in bcm_rx_setup() with a new
per-op bcm_rx_update_lock, taken with the matching scope in the RX
handlers. memcpy_from_msg() is staged into a temporary buffer before the
lock is taken, since it can sleep and must not run under a spinlock.

hrtimer_cancel() is always called without bcm_rx_update_lock held, since
bcm_rx_timeout_handler()/bcm_rx_thr_handler() take the same lock and a
running callback would otherwise deadlock against the canceller.

Also close a related race: bcm_rx_setup() cleared the RTR flag in the
stored reply frame's can_id as a separate, unprotected step after the
frame content was already installed, so a concurrent bcm_rx_handler()
could transmit a stale reply with CAN_RTR_FLAG still set. Fold that
normalization into the initial frame preparation instead (on the staged
buffer for updates, directly on op->frames pre-registration for new
ops), so the installed frame is always atomically self-consistent.

bcm_rx_handler()'s RX_RTR_FRAME check now takes a lock-protected
snapshot of op->flags before deciding whether to call bcm_can_tx(),
but does not hold the lock across that call.

Also take a lock-protected snapshot of the currframe in bcm_can_tx()
to avoid partly overwrites by content updates in bcm_tx_setup().
Finally check if a TX_RESET_MULTI_IDX/SETTIMER might have reset
op->currframe between the two locked sections in bcm_can_tx().

Omit calling hrtimer_forward() with zero interval in bcm_rx_thr_handler().
kt_ival2 may have been concurrently cleared by bcm_rx_setup() before it
cancels this timer, so check kt_ival2 inside the bcm_rx_update_lock.

Published: 2026-08-15

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race exists between bcm_rx_setup and the CAN receive handlers that can overwrite timer and filter structures while incoming CAN traffic is processed. The concurrent modification can leave the driver in an inconsistent state, causing stale or corrupted CAN frames to be transmitted or legitimate frames to be dropped, which undermines data integrity and could lead to a denial of service on the CAN bus.

Affected Systems

All Linux kernels that contain the vulnerable bcm driver code are affected. The CNA list the vendor as Linux, but no specific version ranges are provided Users should verify if their kernel includes the bcm_rx_setup and related handlers and apply a kernel version that implements the locking changes.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, while the EPSS score is less than 1%, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is a race condition in a kernel driver, the most likely attack vector involves an attacker sending crafted CAN traffic, either locally or from a remote source, to trigger concurrent access to bcm_rx_setup and the receive handlers. This could disrupt CAN communication or corrupt data, leading to unexpected CAN bus behavior or system instability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7595de7bc56e0e52b74e56c90f7e247bf626d628`	affected	< 96994180bd7b248b0cc698afe926e23fc1bda59b
`fbd8fdc2b218e979cfe422b139b8f74c12419d1f`	affected	< caa8704a7f3cb7806331596195385437126ecb3a
`2a437b86ac5a9893c902f30ef66815bf13587bf6`	affected	< a7c369e7da8203e2b5be12bbcac7b9ab2ed5b658
`76c84c3728178b2d38d5604e399dfe8b0752645e`	affected	< a7eb6db1cd3f7b556a301dc1265945ad112089f7
`cc55dd28c20a6611e30596019b3b2f636819a4c0`	affected	< 834cbca3b12e46887f7a9b35f1981a888360ea4c
`c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7`	affected	< 19b1994069dd29478ba767de1f98f14a088198dc
`c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7`	affected	< fc9f5ee1b073bd233d9c604e338af4ebb42cbc33
`c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7`	affected	< 749179c2e25b95d22499ed29096b3e02d6dfd2b4
`8f1c022541bf5a923c8d6fa483112c15250f30a4`	affected	—
`c4e8a172501e677ebd8ea9d9161d97dc4df56fbd`	affected	—
`5.10.238`	affected	< 5.10.265
`5.15.185`	affected	< 5.15.216
`6.1.141`	affected	< 6.1.183
`6.6.93`	affected	< 6.6.148
`6.12.31`	affected	< 6.12.101
`5.4.294`	affected	< 5.5
`6.14.9`	affected	< 6.15

Linux

affected

Version	Status	Constraints
`6.15`	affected	—
`0`	unaffected	< 6.15
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[76c84c3728178b2d38d5604e399dfe8b0752645e,a7eb6db1cd3f7b556a301dc1265945ad112089f7)`	affected	code_commit	—
`[cc55dd28c20a6611e30596019b3b2f636819a4c0,834cbca3b12e46887f7a9b35f1981a888360ea4c)`	affected	code_commit	—
`[c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7,19b1994069dd29478ba767de1f98f14a088198dc)`	affected	code_commit	—
`[c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7,fc9f5ee1b073bd233d9c604e338af4ebb42cbc33)`	affected	code_commit	—
`[c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7,749179c2e25b95d22499ed29096b3e02d6dfd2b4)`	affected	code_commit	—
`[8f1c022541bf5a923c8d6fa483112c15250f30a4,8f1c022541bf5a923c8d6fa483112c15250f30a4]`	affected	code_commit	—
`[7595de7bc56e0e52b74e56c90f7e247bf626d628,7595de7bc56e0e52b74e56c90f7e247bf626d628]`	affected	code_commit	—
`[fbd8fdc2b218e979cfe422b139b8f74c12419d1f,fbd8fdc2b218e979cfe422b139b8f74c12419d1f]`	affected	code_commit	—
`[2a437b86ac5a9893c902f30ef66815bf13587bf6,2a437b86ac5a9893c902f30ef66815bf13587bf6]`	affected	code_commit	—
`[c4e8a172501e677ebd8ea9d9161d97dc4df56fbd,c4e8a172501e677ebd8ea9d9161d97dc4df56fbd]`	affected	code_commit	—
`[6.6.93,6.6.148)`	affected	semver	—
`[6.12.31,6.12.101)`	affected	semver	—
`[5.4.294,5.5)`	affected	semver	—
`[5.10.238,5.11)`	affected	semver	—
`[5.15.185,5.16)`	affected	semver	—
`[6.1.141,6.2)`	affected	semver	—
`[6.14.9,6.15)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.15,6.15]`	affected	semver	—
`[0,6.15)`	unaffected	semver	—
`[6.6.148,6.6.*]`	unaffected	generic	—
`[6.12.101,6.12.*]`	unaffected	generic	—
`[6.18.42,6.18.*]`	unaffected	generic	—
`[7.1.5,7.1.*]`	unaffected	generic	—
`[7.2-rc4,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest stable kernel that includes the bcm_rx_update_lock changes
Reboot the system to load the updated kernel
Monitor the CAN traffic for stability and absence of stale frames after the update

Generated by OpenCVE AI on August 18, 2026 at 04:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00345.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/19b1994069dd29478ba767de1f98f14a088198dc
https://git.kernel.org/stable/c/749179c2e25b95d22499ed29096b3e02d6dfd2b4
https://git.kernel.org/stable/c/834cbca3b12e46887f7a9b35f1981a888360ea4c
https://git.kernel.org/stable/c/96994180bd7b248b0cc698afe926e23fc1bda59b
https://git.kernel.org/stable/c/a7c369e7da8203e2b5be12bbcac7b9ab2ed5b658
https://git.kernel.org/stable/c/a7eb6db1cd3f7b556a301dc1265945ad112089f7
https://git.kernel.org/stable/c/caa8704a7f3cb7806331596195385437126ecb3a
https://git.kernel.org/stable/c/fc9f5ee1b073bd233d9c604e338af4ebb42cbc33
https://lore.kernel.org/linux-cve-announce/2026081528-CVE-2026-72121-9a44@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72121
https://www.cve.org/CVERecord?id=CVE-2026-72121

History

Wed, 19 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/96994180bd7b248b0cc698afe926e23fc1bda59b https://git.kernel.org/stable/c/a7c369e7da8203e2b5be12bbcac7b9ab2ed5b658 https://git.kernel.org/stable/c/caa8704a7f3cb7806331596195385437126ecb3a

Tue, 18 Aug 2026 03:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362

Tue, 18 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-367
References		https://lore.kernel.org/linux-cve-announce/2026081528-CVE-2026-72121-9a44@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72121 https://www.cve.org/CVERecord?id=CVE-2026-72121
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362

Mon, 17 Aug 2026 08:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and timer values KCSAN detected a simultaneous access to timer values that can be overwritten in bcm_rx_setup() when updating timer and filter content while bcm_rx_handler(), bcm_rx_timeout_handler() or bcm_rx_thr_handler() run concurrently on incoming CAN traffic. Protect the timer (ival1/ival2/kt_ival1/kt_ival2/kt_lastmsg) and filter (nframes/flags/frames/last_frames) updates in bcm_rx_setup() with a new per-op bcm_rx_update_lock, taken with the matching scope in the RX handlers. memcpy_from_msg() is staged into a temporary buffer before the lock is taken, since it can sleep and must not run under a spinlock. hrtimer_cancel() is always called without bcm_rx_update_lock held, since bcm_rx_timeout_handler()/bcm_rx_thr_handler() take the same lock and a running callback would otherwise deadlock against the canceller. Also close a related race: bcm_rx_setup() cleared the RTR flag in the stored reply frame's can_id as a separate, unprotected step after the frame content was already installed, so a concurrent bcm_rx_handler() could transmit a stale reply with CAN_RTR_FLAG still set. Fold that normalization into the initial frame preparation instead (on the staged buffer for updates, directly on op->frames pre-registration for new ops), so the installed frame is always atomically self-consistent. bcm_rx_handler()'s RX_RTR_FRAME check now takes a lock-protected snapshot of op->flags before deciding whether to call bcm_can_tx(), but does not hold the lock across that call. Also take a lock-protected snapshot of the currframe in bcm_can_tx() to avoid partly overwrites by content updates in bcm_tx_setup(). Finally check if a TX_RESET_MULTI_IDX/SETTIMER might have reset op->currframe between the two locked sections in bcm_can_tx(). Omit calling hrtimer_forward() with zero interval in bcm_rx_thr_handler(). kt_ival2 may have been concurrently cleared by bcm_rx_setup() before it cancels this timer, so check kt_ival2 inside the bcm_rx_update_lock.
Title		can: bcm: add locking when updating filter and timer values
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/19b1994069dd29478ba767de1f98f14a088198dc https://git.kernel.org/stable/c/749179c2e25b95d22499ed29096b3e02d6dfd2b4 https://git.kernel.org/stable/c/834cbca3b12e46887f7a9b35f1981a888360ea4c https://git.kernel.org/stable/c/a7eb6db1cd3f7b556a301dc1265945ad112089f7 https://git.kernel.org/stable/c/fc9f5ee1b073bd233d9c604e338af4ebb42cbc33

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:52:59.959Z

Updated: 2026-08-19T16:36:16.520Z

Reserved: 2026-08-09T03:40:39.907Z

Link: CVE-2026-72121

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:26.650

Modified: 2026-08-19T17:20:59.160

Link: CVE-2026-72121

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72121 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-18T04:45:04Z

Weaknesses

CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object