CVE-2026-72115can: bcm: track a single source interface for ANYDEV timeout/throttle ops
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for ANYDEV timeout/throttle ops An ANYDEV rx op (ifindex == 0) with an active RX timeout and/or throttle timer has no defined semantics when matching frames arrive from several interfaces: bcm_rx_handler() can run concurrently for the same op on different CPUs, racing hrtimer_cancel()/ bcm_rx_starttimer() against bcm_rx_timeout_handler() and causing spurious RX_TIMEOUT notifications and last_frames corruption. The same concurrency lets throttled multiplex frames from different interfaces clobber the single rx_ifindex/rx_stamp fields shared by the op. Add op->if_detected to track the first interface that delivers a matching frame while a timeout/throttle timer is configured, and reject frames from any other interface for that op. The claim is decided in bcm_rx_handler() before hrtimer_cancel() touches op->timer, so a rejected frame can never disturb the claimed interface's watchdog. RTR-mode ops are excluded via RX_RTR_FRAME, independent of kt_ival1/kt_ival2, since those may briefly hold a stale value from an earlier non-RTR configuration. The claim is released in bcm_notify() on NETDEV_UNREGISTER and in bcm_rx_setup() when SETTIMER reconfigures the timer values. A (re-)claim is only possible on CAN devices in NETREG_REGISTERED dev->reg_state to cover the release in bcm_notify() where reg_state becomes NETREG_UNREGISTERING until synchronize_net().
- CVSS
- 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ffd980f976e7fd666c2e61bf8ab35107efd11828 before f147f48837cb1426521f5b3c3b3134c71128a25d; from ffd980f976e7fd666c2e61bf8ab35107efd11828 before 57cf104da4cf450ae9c16801a3164604b801d2cc; from ffd980f976e7fd666c2e61bf8ab35107efd11828 before 03dfe347c398fa41a7e30e8dc538f12568c183e6; from ffd980f976e7fd666c2e61bf8ab35107efd11828 before 18b45251e74e35668f0dd0c470549384ae191ecf; from ffd980f976e7fd666c2e61bf8ab35107efd11828 before 3ff8c24b421070a2db99a5cdb86edc9ff339418e; from ffd980f976e7fd666c2e61bf8ab35107efd11828 before eca8b44d51fc6ab61022258ec968e55e3073b79e; from ffd980f976e7fd666c2e61bf8ab35107efd11828 before b6317022b685a430a3ae420456716e3c0c02ef4b; from ffd980f976e7fd666c2e61bf8ab35107efd11828 before 2f5976f54a04e9f18b25283036ac3136be453b17 | CNA record |
References
- https://git.kernel.org/stable/c/f147f48837cb1426521f5b3c3b3134c71128a25d
- https://git.kernel.org/stable/c/57cf104da4cf450ae9c16801a3164604b801d2cc
- https://git.kernel.org/stable/c/03dfe347c398fa41a7e30e8dc538f12568c183e6
- https://git.kernel.org/stable/c/18b45251e74e35668f0dd0c470549384ae191ecf
- https://git.kernel.org/stable/c/3ff8c24b421070a2db99a5cdb86edc9ff339418e
- https://git.kernel.org/stable/c/eca8b44d51fc6ab61022258ec968e55e3073b79e
- https://git.kernel.org/stable/c/b6317022b685a430a3ae420456716e3c0c02ef4b
- https://git.kernel.org/stable/c/2f5976f54a04e9f18b25283036ac3136be453b17
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.