CVE-2026-72120can: bcm: add missing rcu list annotations and operations
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu list annotations and operations sashiko-bot remarked the missing use of list_add_rcu() in bcm_[rx|tx]_setup() to have a proper initialized bcm_op structure when bcm_proc_show() traverses the bcm_op's under rcu_read_lock(). To cover all initial settings of the bcm_op's the list_add_rcu() calls are moved to the end of the setup code. While at it, also fix the mirroring removal side: bcm_release() called bcm_remove_op() - which frees the op via call_rcu() - on ops that were still linked in bo->tx_ops/bo->rx_ops, without list_del_rcu() first. Unlink each op with list_del_rcu() before handing it to bcm_remove_op(), matching the existing pattern in bcm_delete_tx_op()/bcm_delete_rx_op().
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 659701c0b954ccdb4a916a4ad59bbc16e726d42c before 8357255e56dc1aaa437e3c53ee9385de984e0d57; 0622846db728a5332b917c797c733e202c4620ae builds before 8e1c7257c81577130f5ce90f69b2a2c3ce63f957; from 6d7d458c41b98a5c1670cbd36f2923c37de51cf5 before eb1c26eab4d1f0b4450439b4b88c3e73faf1da98; from 1f912f8484e9c4396378c39460bbea0af681f319 before f53bdab85e64eb57d6899a30d1307fd5a3639cc7; 63567ecd99a24495208dc860d50fb17440043006 builds before 4e22e8b505f877573bbdfdbcb680babad9b2f7a1; from dac5e6249159ac255dad9781793dbe5908ac9ddb before b06a4a397ac826603f39875cb7c7819a41365196; from dac5e6249159ac255dad9781793dbe5908ac9ddb before 30f7bb922cb7e7f072a56c7cb7a5efccd2ceca1d; from dac5e6249159ac255dad9781793dbe5908ac9ddb before 7b2c3eabc4dafc062a25e10711154f2107526a78; and 9 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/8357255e56dc1aaa437e3c53ee9385de984e0d57
- https://git.kernel.org/stable/c/8e1c7257c81577130f5ce90f69b2a2c3ce63f957
- https://git.kernel.org/stable/c/eb1c26eab4d1f0b4450439b4b88c3e73faf1da98
- https://git.kernel.org/stable/c/f53bdab85e64eb57d6899a30d1307fd5a3639cc7
- https://git.kernel.org/stable/c/4e22e8b505f877573bbdfdbcb680babad9b2f7a1
- https://git.kernel.org/stable/c/b06a4a397ac826603f39875cb7c7819a41365196
- https://git.kernel.org/stable/c/30f7bb922cb7e7f072a56c7cb7a5efccd2ceca1d
- https://git.kernel.org/stable/c/7b2c3eabc4dafc062a25e10711154f2107526a78
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.