High 7.8Published Aug 15, 2026

CVE-2026-72113can: bcm: add missing device refcount for CAN filter removal

Updated under an hour ago (2026-10-19 06:10 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing device refcount for CAN filter removal sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is present in the bcm.c code. A former fix for raw.c commit c275a176e4b6 ("can: raw: add missing refcount for memory leak fix") introduced a netdevice_tracker which solves the issue for bcm.c too. bcm_release(), bcm_delete_rx_op() and bcm_notifier() relied on dev_get_by_index(ifindex) to re-find the device for an rx_op before unregistering its filter. If a concurrent NETDEV_UNREGISTER has already unlisted the device from the ifindex table, that lookup fails and can_rx_unregister() is silently skipped, leaving a stale CAN filter pointing at the soon-to-be-freed bcm_op/socket. Hold a netdev_hold()/netdev_put() tracked reference on op->rx_reg_dev from the moment the rx filter is registered in bcm_rx_setup() until it is unregistered in bcm_rx_unreg(), and use that reference directly in bcm_release() and bcm_delete_rx_op() instead of re-looking the device up by ifindex.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ffd980f976e7fd666c2e61bf8ab35107efd11828 before bd5232663524e94cc5aad861dca11e3db8e2ab6f; from ffd980f976e7fd666c2e61bf8ab35107efd11828 before ee8b36d0faca08f35b889b6e9aa850695e5b8ba9; from ffd980f976e7fd666c2e61bf8ab35107efd11828 before dcaee869913c7210cd47ed0a8f27349d7bdcdb7b; from ffd980f976e7fd666c2e61bf8ab35107efd11828 before 84aa4807816e405c1bf87114fc63e06d244281ef; from ffd980f976e7fd666c2e61bf8ab35107efd11828 before 633bda66fbf309f5de5e1ad6defe8e6b1d77a20f; from ffd980f976e7fd666c2e61bf8ab35107efd11828 before b024c21c9066f6957b7d4a8f2037e4b000c5e041; from ffd980f976e7fd666c2e61bf8ab35107efd11828 before 04d23061bbf18d5d81022eb21e9d32e99d24468d; from ffd980f976e7fd666c2e61bf8ab35107efd11828 before d59948293ea34b6337ce2b5febab8510de70048c	CNA record

References

https://git.kernel.org/stable/c/bd5232663524e94cc5aad861dca11e3db8e2ab6f
https://git.kernel.org/stable/c/ee8b36d0faca08f35b889b6e9aa850695e5b8ba9
https://git.kernel.org/stable/c/dcaee869913c7210cd47ed0a8f27349d7bdcdb7b
https://git.kernel.org/stable/c/84aa4807816e405c1bf87114fc63e06d244281ef
https://git.kernel.org/stable/c/633bda66fbf309f5de5e1ad6defe8e6b1d77a20f
https://git.kernel.org/stable/c/b024c21c9066f6957b7d4a8f2037e4b000c5e041
https://git.kernel.org/stable/c/04d23061bbf18d5d81022eb21e9d32e99d24468d
https://git.kernel.org/stable/c/d59948293ea34b6337ce2b5febab8510de70048c

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.