CVE-2026-72126 (GCVE-0-2026-72126)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:53 – Updated: 2026-08-17 05:40
VLAI
Title
can: isotp: use unconditional synchronize_rcu() in isotp_release()
Summary
In the Linux kernel, the following vulnerability has been resolved: can: isotp: use unconditional synchronize_rcu() in isotp_release() isotp_notify() unregisters the (RCU) CAN filters via can_rx_unregister() and clears so->bound without waiting for a grace period. isotp_release() uses so->bound to decide whether it needs to call synchronize_rcu() before cancelling so->rxtimer, so when NETDEV_UNREGISTER runs first it skips that synchronize_rcu() and can cancel the timer while an in-flight isotp_rcv() is still executing and about to re-arm it via isotp_send_fc(), leading to a use-after-free timer callback on the freed socket. sakisho-bot remarked a problem with rtnl_lock held in isotp_notify(), therefore make isotp_release() always call synchronize_rcu() before cancelling the timers, regardless of so->bound. This still closes the original race (isotp_notify() clearing so->bound without waiting for in-flight isotp_rcv() callers before isotp_release() cancels the RX timer) without adding any RCU wait to the netdevice notifier path.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 22bfa94db2ef6900c790884fa9461486516626e9 , < 945d9894502cd9124f5d676181c542ed2000f7c0 (git)
Affected: 14a4696bc3118ba49da28f79280e1d55603aa737 , < 59672aa4bcd8d32172c1ff6a179583981d6acabc (git)
Affected: 14a4696bc3118ba49da28f79280e1d55603aa737 , < 15413a082df69175c2f96aeab4c26fe1ff7cff03 (git)
Affected: 14a4696bc3118ba49da28f79280e1d55603aa737 , < 6280eda96e0707264849fa7d036fed873c1f8a6d (git)
Affected: 14a4696bc3118ba49da28f79280e1d55603aa737 , < cb6abc584a1bfab107ac003d64948a4aef1730aa (git)
Affected: 14a4696bc3118ba49da28f79280e1d55603aa737 , < b88a511308779c225005d7994b8744561bdbafbc (git)
Affected: 14a4696bc3118ba49da28f79280e1d55603aa737 , < b8278ff605187ef3fa0f2705e93251cce4c4f8ee (git)
Affected: 14a4696bc3118ba49da28f79280e1d55603aa737 , < 9b1a02e0d980ac6b0e36a90378f847062f81d7e4 (git)
Affected: 80c6ddf771df2ef786f28c1ca5919b3f1080091b (git)
Affected: ebf91625b3e404bd2b4b694c7ee71c1e8f8bd08f (git)
Affected: 5.10.50 , < 5.10.261 (semver)
Affected: 5.12.17 , < 5.13 (semver)
Affected: 5.13.2 , < 5.14 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/can/isotp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "945d9894502cd9124f5d676181c542ed2000f7c0",
              "status": "affected",
              "version": "22bfa94db2ef6900c790884fa9461486516626e9",
              "versionType": "git"
            },
            {
              "lessThan": "59672aa4bcd8d32172c1ff6a179583981d6acabc",
              "status": "affected",
              "version": "14a4696bc3118ba49da28f79280e1d55603aa737",
              "versionType": "git"
            },
            {
              "lessThan": "15413a082df69175c2f96aeab4c26fe1ff7cff03",
              "status": "affected",
              "version": "14a4696bc3118ba49da28f79280e1d55603aa737",
              "versionType": "git"
            },
            {
              "lessThan": "6280eda96e0707264849fa7d036fed873c1f8a6d",
              "status": "affected",
              "version": "14a4696bc3118ba49da28f79280e1d55603aa737",
              "versionType": "git"
            },
            {
              "lessThan": "cb6abc584a1bfab107ac003d64948a4aef1730aa",
              "status": "affected",
              "version": "14a4696bc3118ba49da28f79280e1d55603aa737",
              "versionType": "git"
            },
            {
              "lessThan": "b88a511308779c225005d7994b8744561bdbafbc",
              "status": "affected",
              "version": "14a4696bc3118ba49da28f79280e1d55603aa737",
              "versionType": "git"
            },
            {
              "lessThan": "b8278ff605187ef3fa0f2705e93251cce4c4f8ee",
              "status": "affected",
              "version": "14a4696bc3118ba49da28f79280e1d55603aa737",
              "versionType": "git"
            },
            {
              "lessThan": "9b1a02e0d980ac6b0e36a90378f847062f81d7e4",
              "status": "affected",
              "version": "14a4696bc3118ba49da28f79280e1d55603aa737",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "80c6ddf771df2ef786f28c1ca5919b3f1080091b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ebf91625b3e404bd2b4b694c7ee71c1e8f8bd08f",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.261",
              "status": "affected",
              "version": "5.10.50",
              "versionType": "semver"
            },
            {
              "lessThan": "5.13",
              "status": "affected",
              "version": "5.12.17",
              "versionType": "semver"
            },
            {
              "lessThan": "5.14",
              "status": "affected",
              "version": "5.13.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/can/isotp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.10.50",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.12.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.13.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: isotp: use unconditional synchronize_rcu() in isotp_release()\n\nisotp_notify() unregisters the (RCU) CAN filters via can_rx_unregister()\nand clears so-\u003ebound without waiting for a grace period. isotp_release()\nuses so-\u003ebound to decide whether it needs to call synchronize_rcu()\nbefore cancelling so-\u003erxtimer, so when NETDEV_UNREGISTER runs first it\nskips that synchronize_rcu() and can cancel the timer while an\nin-flight isotp_rcv() is still executing and about to re-arm it via\nisotp_send_fc(), leading to a use-after-free timer callback on the\nfreed socket.\n\nsakisho-bot remarked a problem with rtnl_lock held in isotp_notify(),\ntherefore make isotp_release() always call synchronize_rcu() before\ncancelling the timers, regardless of so-\u003ebound. This still closes the\noriginal race (isotp_notify() clearing so-\u003ebound without waiting for\nin-flight isotp_rcv() callers before isotp_release() cancels the RX\ntimer) without adding any RCU wait to the netdevice notifier path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached through local AF_CAN CAN_ISOTP socket syscalls (socket/bind/close) racing in-kernel ISO-TP RX; a CAN peer can deliver frames, but exploitation requires a local process to close the socket while NETDEV_UNREGISTER clears so-\u003ebound.\nAC:L - The attacker controls all race sides: ISO-TP RX traffic via a local CAN socket or bus peer, concurrent close() on the ISOTP socket, and NETDEV_UNREGISTER by deleting the bound vcan/CAN interface (e.g., in a user namespace with CAP_NET_ADMIN).\nPR:L - CAN_ISOTP socket create/bind/sendmsg/close paths impose no CAP_NET_ADMIN check; an unprivileged local user with access to a CAN netdev, including a user-namespace vcan they create, can reach the vulnerable release/timer path.\nUI:N - No victim interaction is required once the attacker can execute local code; they can open the ISO-TP socket, drive RX via CAN frames, delete the netdev, and close the socket to race isotp_rcv() against isotp_release().\nS:U - Exploitation corrupts kernel heap memory within the same OS security boundary (standard kernel UAF), not a VM/host or IOMMU sandbox escape.\nC:H - Use-after-free of struct isotp_sock in isotp_rx_timer_handler reads freed memory (so-\u003erx.state, sock fields), enabling heap grooming for arbitrary kernel memory disclosure per conservative UAF scoring guidance.\nI:H - The timer callback performs writes to fields within the freed isotp_sock/socket object, giving attacker-influenced kernel heap corruption that can be developed into arbitrary write or privilege-escalation primitives.\nA:H - Executing isotp_rx_timer_handler on a freed socket can cause kernel oops/panic or fatal memory corruption; the UAF is reliably triggerable with attacker-controlled timing."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:40:40.020Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/945d9894502cd9124f5d676181c542ed2000f7c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/59672aa4bcd8d32172c1ff6a179583981d6acabc"
        },
        {
          "url": "https://git.kernel.org/stable/c/15413a082df69175c2f96aeab4c26fe1ff7cff03"
        },
        {
          "url": "https://git.kernel.org/stable/c/6280eda96e0707264849fa7d036fed873c1f8a6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb6abc584a1bfab107ac003d64948a4aef1730aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/b88a511308779c225005d7994b8744561bdbafbc"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8278ff605187ef3fa0f2705e93251cce4c4f8ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b1a02e0d980ac6b0e36a90378f847062f81d7e4"
        }
      ],
      "title": "can: isotp: use unconditional synchronize_rcu() in isotp_release()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72126",
    "datePublished": "2026-08-15T05:53:03.642Z",
    "dateReserved": "2026-08-09T03:40:39.907Z",
    "dateUpdated": "2026-08-17T05:40:40.020Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72126",
      "date": "2026-09-23",
      "epss": "0.00159",
      "percentile": "0.05513"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/can/isotp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "945d9894502cd9124f5d676181c542ed2000f7c0",
                    "status": "affected",
                    "version": "22bfa94db2ef6900c790884fa9461486516626e9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "59672aa4bcd8d32172c1ff6a179583981d6acabc",
                    "status": "affected",
                    "version": "14a4696bc3118ba49da28f79280e1d55603aa737",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "15413a082df69175c2f96aeab4c26fe1ff7cff03",
                    "status": "affected",
                    "version": "14a4696bc3118ba49da28f79280e1d55603aa737",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6280eda96e0707264849fa7d036fed873c1f8a6d",
                    "status": "affected",
                    "version": "14a4696bc3118ba49da28f79280e1d55603aa737",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cb6abc584a1bfab107ac003d64948a4aef1730aa",
                    "status": "affected",
                    "version": "14a4696bc3118ba49da28f79280e1d55603aa737",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b88a511308779c225005d7994b8744561bdbafbc",
                    "status": "affected",
                    "version": "14a4696bc3118ba49da28f79280e1d55603aa737",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b8278ff605187ef3fa0f2705e93251cce4c4f8ee",
                    "status": "affected",
                    "version": "14a4696bc3118ba49da28f79280e1d55603aa737",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9b1a02e0d980ac6b0e36a90378f847062f81d7e4",
                    "status": "affected",
                    "version": "14a4696bc3118ba49da28f79280e1d55603aa737",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "80c6ddf771df2ef786f28c1ca5919b3f1080091b",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "ebf91625b3e404bd2b4b694c7ee71c1e8f8bd08f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.10.261",
                    "status": "affected",
                    "version": "5.10.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.13",
                    "status": "affected",
                    "version": "5.12.17",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.14",
                    "status": "affected",
                    "version": "5.13.2",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/can/isotp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.14"
                  },
                  {
                    "lessThan": "5.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: isotp: use unconditional synchronize_rcu() in isotp_release()\n\nisotp_notify() unregisters the (RCU) CAN filters via can_rx_unregister()\nand clears so-\u003ebound without waiting for a grace period. isotp_release()\nuses so-\u003ebound to decide whether it needs to call synchronize_rcu()\nbefore cancelling so-\u003erxtimer, so when NETDEV_UNREGISTER runs first it\nskips that synchronize_rcu() and can cancel the timer while an\nin-flight isotp_rcv() is still executing and about to re-arm it via\nisotp_send_fc(), leading to a use-after-free timer callback on the\nfreed socket.\n\nsakisho-bot remarked a problem with rtnl_lock held in isotp_notify(),\ntherefore make isotp_release() always call synchronize_rcu() before\ncancelling the timers, regardless of so-\u003ebound. This still closes the\noriginal race (isotp_notify() clearing so-\u003ebound without waiting for\nin-flight isotp_rcv() callers before isotp_release() cancels the RX\ntimer) without adding any RCU wait to the netdevice notifier path."
          }
        ],
        "id": "CVE-2026-72126",
        "lastModified": "2026-08-17T06:18:12.213",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:29.963",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/15413a082df69175c2f96aeab4c26fe1ff7cff03"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/59672aa4bcd8d32172c1ff6a179583981d6acabc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6280eda96e0707264849fa7d036fed873c1f8a6d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/945d9894502cd9124f5d676181c542ed2000f7c0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9b1a02e0d980ac6b0e36a90378f847062f81d7e4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b8278ff605187ef3fa0f2705e93251cce4c4f8ee"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b88a511308779c225005d7994b8744561bdbafbc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cb6abc584a1bfab107ac003d64948a4aef1730aa"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T23:09:23+00:00",
      "cve": "CVE-2026-72126",
      "id": "CVE-2026-72126",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: can: isotp: use unconditional synchronize_rcu() in isotp_release()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72126.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-01T17:14:31Z",
      "cve": "CVE-2026-72126",
      "id": "CVE-2026-72126",
      "initial_release_date": "2026-08-31T13:30:38Z",
      "product_status:known_affected": "126",
      "product_status:known_not_affected": "236",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72126",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72126.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.