CVE-2026-72123 (GCVE-0-2026-72123)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:53 – Updated: 2026-08-19 16:36
VLAI
Title
can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
Summary
In the Linux kernel, the following vulnerability has been resolved: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF Commit f1b4e32aca08 ("can: bcm: use call_rcu() instead of costly synchronize_rcu()") replaced synchronize_rcu() in bcm_delete_rx_op() with call_rcu() and introduced the RX_NO_AUTOTIMER flag. However, this flag check was omitted for thrtimer in the packet rx fast-path. During BCM RX operation teardown, a concurrent RCU reader (bcm_rx_handler) can race and re-arm thrtimer via bcm_rx_update_and_send() after call_rcu() has been scheduled. Once the RCU grace period elapses, bcm_op is freed. The subsequently firing thrtimer then dereferences the deallocated op, causing a UAF. Adding flag checks to the rx fast-path (bcm_rx_update_and_send) does not fully close the TOCTOU race and introduces latency for every CAN frame. Conversely, calling hrtimer_cancel() directly inside the RCU callback (softirq context) is fatal as hrtimer_cancel() can sleep, triggering a "scheduling while atomic" panic. Resolve this by deferring the timer cancellation and memory free to a dedicated unbound workqueue (bcm_wq). The RCU callback now queues a work item to bcm_wq, which safely cancels both timers and deallocates memory in sleepable process context. A dedicated workqueue is used to prevent system-wide WQ saturation and is cleanly flushed/destroyed on module unload to avoid rmmod page faults. Since the deferred work can now outlive the calling context by an unbounded amount, also take a reference on op->sk when it is assigned and drop it only once the deferred work has cancelled both timers, so a socket can no longer be freed out from under a still-armed timer whose callback (bcm_send_to_user()) dereferences op->sk.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 85cd41070df992d3c0dfd828866fdd243d3b774a , < de5fce46637de05bef56ec08528127676eb6fc9b (git)
Affected: f34f2a18e47b73e48f90a757e1f4aaa8c7d665a1 , < 036a8c320ca11bc912e8027adcfad14b326f067e (git)
Affected: f1b4e32aca0811aa011c76e5d6cf2fa19224b386 , < 3cf4fd5316f449811d8baf1bc6978ef5a7b743a9 (git)
Affected: f1b4e32aca0811aa011c76e5d6cf2fa19224b386 , < 4177762f70646ac48a2af382e45a795cbd295198 (git)
Affected: f1b4e32aca0811aa011c76e5d6cf2fa19224b386 , < 6fd08e8d826c3aa4cc7021f5f9cdbb7fa7441d3f (git)
Affected: f1b4e32aca0811aa011c76e5d6cf2fa19224b386 , < cd830e0bc25ee2d38cbfbdbb3cd77c5f53b2b6d5 (git)
Affected: f1b4e32aca0811aa011c76e5d6cf2fa19224b386 , < ce2d4b121fb7545e1ed588e860c8e5fd5ad45224 (git)
Affected: f1b4e32aca0811aa011c76e5d6cf2fa19224b386 , < 68973f9db76144825e4f35dfdc80fb8279eb2d57 (git)
Affected: fbac09a3b8890003c0c55294c00709f3ae5501bb (git)
Affected: 5b48f5711f1c630841ab78dcc061de902f0e37bf (git)
Affected: edb4baffb9483141a50fb7f7146cfe4a4c0c2db8 (git)
Affected: 5.10.130 , < 5.10.265 (semver)
Affected: 5.15.54 , < 5.15.216 (semver)
Affected: 4.19.252 , < 4.20 (semver)
Affected: 5.4.205 , < 5.5 (semver)
Affected: 5.18.11 , < 5.19 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/can/bcm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "de5fce46637de05bef56ec08528127676eb6fc9b",
              "status": "affected",
              "version": "85cd41070df992d3c0dfd828866fdd243d3b774a",
              "versionType": "git"
            },
            {
              "lessThan": "036a8c320ca11bc912e8027adcfad14b326f067e",
              "status": "affected",
              "version": "f34f2a18e47b73e48f90a757e1f4aaa8c7d665a1",
              "versionType": "git"
            },
            {
              "lessThan": "3cf4fd5316f449811d8baf1bc6978ef5a7b743a9",
              "status": "affected",
              "version": "f1b4e32aca0811aa011c76e5d6cf2fa19224b386",
              "versionType": "git"
            },
            {
              "lessThan": "4177762f70646ac48a2af382e45a795cbd295198",
              "status": "affected",
              "version": "f1b4e32aca0811aa011c76e5d6cf2fa19224b386",
              "versionType": "git"
            },
            {
              "lessThan": "6fd08e8d826c3aa4cc7021f5f9cdbb7fa7441d3f",
              "status": "affected",
              "version": "f1b4e32aca0811aa011c76e5d6cf2fa19224b386",
              "versionType": "git"
            },
            {
              "lessThan": "cd830e0bc25ee2d38cbfbdbb3cd77c5f53b2b6d5",
              "status": "affected",
              "version": "f1b4e32aca0811aa011c76e5d6cf2fa19224b386",
              "versionType": "git"
            },
            {
              "lessThan": "ce2d4b121fb7545e1ed588e860c8e5fd5ad45224",
              "status": "affected",
              "version": "f1b4e32aca0811aa011c76e5d6cf2fa19224b386",
              "versionType": "git"
            },
            {
              "lessThan": "68973f9db76144825e4f35dfdc80fb8279eb2d57",
              "status": "affected",
              "version": "f1b4e32aca0811aa011c76e5d6cf2fa19224b386",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fbac09a3b8890003c0c55294c00709f3ae5501bb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5b48f5711f1c630841ab78dcc061de902f0e37bf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "edb4baffb9483141a50fb7f7146cfe4a4c0c2db8",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.265",
              "status": "affected",
              "version": "5.10.130",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.216",
              "status": "affected",
              "version": "5.15.54",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.252",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.205",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19",
              "status": "affected",
              "version": "5.18.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/can/bcm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.10.130",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.15.54",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.252",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.205",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.18.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF\n\nCommit f1b4e32aca08 (\"can: bcm: use call_rcu() instead of costly\nsynchronize_rcu()\") replaced synchronize_rcu() in bcm_delete_rx_op()\nwith call_rcu() and introduced the RX_NO_AUTOTIMER flag.\n\nHowever, this flag check was omitted for thrtimer in the packet rx\nfast-path. During BCM RX operation teardown, a concurrent RCU reader\n(bcm_rx_handler) can race and re-arm thrtimer via\nbcm_rx_update_and_send() after call_rcu() has been scheduled.  Once\nthe RCU grace period elapses, bcm_op is freed.  The subsequently\nfiring thrtimer then dereferences the deallocated op, causing a UAF.\n\nAdding flag checks to the rx fast-path (bcm_rx_update_and_send) does not\nfully close the TOCTOU race and introduces latency for every CAN frame.\nConversely, calling hrtimer_cancel() directly inside the RCU callback\n(softirq context) is fatal as hrtimer_cancel() can sleep, triggering\na \"scheduling while atomic\" panic.\n\nResolve this by deferring the timer cancellation and memory free to a\ndedicated unbound workqueue (bcm_wq).  The RCU callback now queues a\nwork item to bcm_wq, which safely cancels both timers and deallocates\nmemory in sleepable process context.  A dedicated workqueue is used to\nprevent system-wide WQ saturation and is cleanly flushed/destroyed\non module unload to avoid rmmod page faults.\n\nSince the deferred work can now outlive the calling context by an\nunbounded amount, also take a reference on op-\u003esk when it is assigned\nand drop it only once the deferred work has cancelled both timers, so a\nsocket can no longer be freed out from under a still-armed timer whose\ncallback (bcm_send_to_user()) dereferences op-\u003esk."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local BCM socket syscalls (sendmsg with RX_SETUP/SETTIMER/ival2 throttling and RX_DELETE); CAN frames can be injected locally via loopback without physical bus access.\nAC:L - The attacker controls both sides of the race by concurrently issuing RX_DELETE teardown and delivering matching CAN frames (e.g., via threads or paired BCM/RAW sockets), making the thrtimer re-arm UAF reliably triggerable.\nPR:L - No kernel capability check gates AF_CAN/CAN_BCM socket creation or bcm_sendmsg opcodes; any unprivileged local user with socket access (including via user namespaces with vcan) can reach the vulnerable path.\nUI:N - No victim interaction is required; the attacker self-triggers the race through their own BCM socket operations and locally injected CAN traffic.\nS:U - Impact is confined to kernel memory corruption and local privilege escalation within the same kernel security boundary, not a cross-boundary escape such as VM or IOMMU bypass.\nC:H - The thrtimer UAF dereferences freed bcm_op fields (locks, frame buffers, op-\u003esk) in bcm_rx_thr_handler/bcm_send_to_user, enabling attacker-controlled heap reuse and arbitrary kernel memory disclosure.\nI:H - UAF on the bcm_op slab object allows heap spraying to corrupt function pointers, timers, and sock structures, providing a standard path to arbitrary kernel writes and local privilege escalation.\nA:H - The freed-op dereference in the hrtimer softirq path causes kernel oops/panic under normal exploitation attempts, and successful memory corruption can crash or hang the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:36:18.988Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/de5fce46637de05bef56ec08528127676eb6fc9b"
        },
        {
          "url": "https://git.kernel.org/stable/c/036a8c320ca11bc912e8027adcfad14b326f067e"
        },
        {
          "url": "https://git.kernel.org/stable/c/3cf4fd5316f449811d8baf1bc6978ef5a7b743a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/4177762f70646ac48a2af382e45a795cbd295198"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fd08e8d826c3aa4cc7021f5f9cdbb7fa7441d3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd830e0bc25ee2d38cbfbdbb3cd77c5f53b2b6d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce2d4b121fb7545e1ed588e860c8e5fd5ad45224"
        },
        {
          "url": "https://git.kernel.org/stable/c/68973f9db76144825e4f35dfdc80fb8279eb2d57"
        }
      ],
      "title": "can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72123",
    "datePublished": "2026-08-15T05:53:01.433Z",
    "dateReserved": "2026-08-09T03:40:39.907Z",
    "dateUpdated": "2026-08-19T16:36:18.988Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72123",
      "date": "2026-09-20",
      "epss": "0.00164",
      "percentile": "0.06065"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/can/bcm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "de5fce46637de05bef56ec08528127676eb6fc9b",
                    "status": "affected",
                    "version": "85cd41070df992d3c0dfd828866fdd243d3b774a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "036a8c320ca11bc912e8027adcfad14b326f067e",
                    "status": "affected",
                    "version": "f34f2a18e47b73e48f90a757e1f4aaa8c7d665a1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3cf4fd5316f449811d8baf1bc6978ef5a7b743a9",
                    "status": "affected",
                    "version": "f1b4e32aca0811aa011c76e5d6cf2fa19224b386",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4177762f70646ac48a2af382e45a795cbd295198",
                    "status": "affected",
                    "version": "f1b4e32aca0811aa011c76e5d6cf2fa19224b386",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6fd08e8d826c3aa4cc7021f5f9cdbb7fa7441d3f",
                    "status": "affected",
                    "version": "f1b4e32aca0811aa011c76e5d6cf2fa19224b386",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cd830e0bc25ee2d38cbfbdbb3cd77c5f53b2b6d5",
                    "status": "affected",
                    "version": "f1b4e32aca0811aa011c76e5d6cf2fa19224b386",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ce2d4b121fb7545e1ed588e860c8e5fd5ad45224",
                    "status": "affected",
                    "version": "f1b4e32aca0811aa011c76e5d6cf2fa19224b386",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "68973f9db76144825e4f35dfdc80fb8279eb2d57",
                    "status": "affected",
                    "version": "f1b4e32aca0811aa011c76e5d6cf2fa19224b386",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "fbac09a3b8890003c0c55294c00709f3ae5501bb",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "5b48f5711f1c630841ab78dcc061de902f0e37bf",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "edb4baffb9483141a50fb7f7146cfe4a4c0c2db8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.10.265",
                    "status": "affected",
                    "version": "5.10.130",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.15.216",
                    "status": "affected",
                    "version": "5.15.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.20",
                    "status": "affected",
                    "version": "4.19.252",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.5",
                    "status": "affected",
                    "version": "5.4.205",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.19",
                    "status": "affected",
                    "version": "5.18.11",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/can/bcm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.19"
                  },
                  {
                    "lessThan": "5.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.265",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF\n\nCommit f1b4e32aca08 (\"can: bcm: use call_rcu() instead of costly\nsynchronize_rcu()\") replaced synchronize_rcu() in bcm_delete_rx_op()\nwith call_rcu() and introduced the RX_NO_AUTOTIMER flag.\n\nHowever, this flag check was omitted for thrtimer in the packet rx\nfast-path. During BCM RX operation teardown, a concurrent RCU reader\n(bcm_rx_handler) can race and re-arm thrtimer via\nbcm_rx_update_and_send() after call_rcu() has been scheduled.  Once\nthe RCU grace period elapses, bcm_op is freed.  The subsequently\nfiring thrtimer then dereferences the deallocated op, causing a UAF.\n\nAdding flag checks to the rx fast-path (bcm_rx_update_and_send) does not\nfully close the TOCTOU race and introduces latency for every CAN frame.\nConversely, calling hrtimer_cancel() directly inside the RCU callback\n(softirq context) is fatal as hrtimer_cancel() can sleep, triggering\na \"scheduling while atomic\" panic.\n\nResolve this by deferring the timer cancellation and memory free to a\ndedicated unbound workqueue (bcm_wq).  The RCU callback now queues a\nwork item to bcm_wq, which safely cancels both timers and deallocates\nmemory in sleepable process context.  A dedicated workqueue is used to\nprevent system-wide WQ saturation and is cleanly flushed/destroyed\non module unload to avoid rmmod page faults.\n\nSince the deferred work can now outlive the calling context by an\nunbounded amount, also take a reference on op-\u003esk when it is assigned\nand drop it only once the deferred work has cancelled both timers, so a\nsocket can no longer be freed out from under a still-armed timer whose\ncallback (bcm_send_to_user()) dereferences op-\u003esk."
          }
        ],
        "id": "CVE-2026-72123",
        "lastModified": "2026-08-19T17:20:59.547",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:29.577",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/036a8c320ca11bc912e8027adcfad14b326f067e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3cf4fd5316f449811d8baf1bc6978ef5a7b743a9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4177762f70646ac48a2af382e45a795cbd295198"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/68973f9db76144825e4f35dfdc80fb8279eb2d57"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6fd08e8d826c3aa4cc7021f5f9cdbb7fa7441d3f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cd830e0bc25ee2d38cbfbdbb3cd77c5f53b2b6d5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ce2d4b121fb7545e1ed588e860c8e5fd5ad45224"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/de5fce46637de05bef56ec08528127676eb6fc9b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-31T11:12:32+00:00",
      "cve": "CVE-2026-72123",
      "id": "CVE-2026-72123",
      "initial_release_date": "2026-05-26T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "93",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: can: bcm: thrtimer use-after-free during RX operation teardown",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72123.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-18T00:28:43Z",
      "cve": "CVE-2026-72123",
      "id": "CVE-2026-72123",
      "initial_release_date": "2026-08-31T13:30:44Z",
      "product_status:first_fixed": "104",
      "product_status:known_affected": "520",
      "product_status:known_not_affected": "216",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72123",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72123.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.