CVE-2026-72117can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() For an rx op subscribed on all interfaces (ifindex == 0), the same op is registered once in the shared per-netns wildcard filter list, so bcm_rx_handler() can run concurrently on different CPUs for frames arriving on different net devices. op->rx_stamp and op->rx_ifindex were written before bcm_rx_update_lock was taken, allowing concurrent writers to race each other - including a torn store of the 64-bit rx_stamp on 32-bit platforms. Beyond a torn store bcm_send_to_user() must report the timestamp/ifindex of the very same frame whose content it is delivering. So the assignment is placed in the same unbroken bcm_rx_update_lock section as the content comparison. As a side effect, the RTR-request frame feature (which never reach bcm_send_to_user()) no longer updates rx_stamp/rx_ifindex, since only the notification path needs them.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ffd980f976e7fd666c2e61bf8ab35107efd11828 before b64f60c468d149aca22ea56bb842b9730215aaa5; from ffd980f976e7fd666c2e61bf8ab35107efd11828 before c8a5d7cb095d3b12bd9dcf752d6ca0ff50872ac5; from ffd980f976e7fd666c2e61bf8ab35107efd11828 before 4b97410f4bba18d2ee2784c8e089104f387bc27c; from ffd980f976e7fd666c2e61bf8ab35107efd11828 before 5f246b96ab47523ec9b8ea870b5c567a3cb1eb1c; from ffd980f976e7fd666c2e61bf8ab35107efd11828 before 656ff69ef235699035e57d9e1ae417e62a38aa7f; from ffd980f976e7fd666c2e61bf8ab35107efd11828 before 136de17f38630307991c59aa7080012a99451783; from ffd980f976e7fd666c2e61bf8ab35107efd11828 before c312b750bb5ac3348cfc85dab25e90937bd4d251; from ffd980f976e7fd666c2e61bf8ab35107efd11828 before 58fd6cbc8541216af1d7ed272ea7ac2b66d50fd8 | CNA record |
References
- https://git.kernel.org/stable/c/b64f60c468d149aca22ea56bb842b9730215aaa5
- https://git.kernel.org/stable/c/c8a5d7cb095d3b12bd9dcf752d6ca0ff50872ac5
- https://git.kernel.org/stable/c/4b97410f4bba18d2ee2784c8e089104f387bc27c
- https://git.kernel.org/stable/c/5f246b96ab47523ec9b8ea870b5c567a3cb1eb1c
- https://git.kernel.org/stable/c/656ff69ef235699035e57d9e1ae417e62a38aa7f
- https://git.kernel.org/stable/c/136de17f38630307991c59aa7080012a99451783
- https://git.kernel.org/stable/c/c312b750bb5ac3348cfc85dab25e90937bd4d251
- https://git.kernel.org/stable/c/58fd6cbc8541216af1d7ed272ea7ac2b66d50fd8
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.