Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-72115— can: bcm: track a single source interface for ANYDEV timeout/throttle ops

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 2.6.25版本存在安全漏洞，该漏洞源于can: bcm模块的ANYDEV接收操作在多个接口同时到达匹配帧时存在竞争条件，可能导致错误的RX_TIMEOUT通知和last_frames数据损坏。

CVSS 8.1 · High EPSS 0.29% · P22

Possible ATT&CK Techniques 1 AI

T1211 · Exploitation for Stealth

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux ffd980f976e7fd666c2e61bf8ab35107efd11828< f147f48837cb1426521f5b3c3b3134c71128a25d affected
ffd980f976e7fd666c2e61bf8ab35107efd11828< 57cf104da4cf450ae9c16801a3164604b801d2cc affected
ffd980f976e7fd666c2e61bf8ab35107efd11828< 03dfe347c398fa41a7e30e8dc538f12568c183e6 affected
ffd980f976e7fd666c2e61bf8ab35107efd11828< 18b45251e74e35668f0dd0c470549384ae191ecf affected
ffd980f976e7fd666c2e61bf8ab35107efd11828< 3ff8c24b421070a2db99a5cdb86edc9ff339418e affected
ffd980f976e7fd666c2e61bf8ab35107efd11828< eca8b44d51fc6ab61022258ec968e55e3073b79e affected
ffd980f976e7fd666c2e61bf8ab35107efd11828< b6317022b685a430a3ae420456716e3c0c02ef4b affected
ffd980f976e7fd666c2e61bf8ab35107efd11828< 2f5976f54a04e9f18b25283036ac3136be453b17 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-72115

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
can: bcm: track a single source interface for ANYDEV timeout/throttle ops
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for ANYDEV timeout/throttle ops An ANYDEV rx op (ifindex == 0) with an active RX timeout and/or throttle timer has no defined semantics when matching frames arrive from several interfaces: bcm_rx_handler() can run concurrently for the same op on different CPUs, racing hrtimer_cancel()/ bcm_rx_starttimer() against bcm_rx_timeout_handler() and causing spurious RX_TIMEOUT notifications and last_frames corruption. The same concurrency lets throttled multiplex frames from different interfaces clobber the single rx_ifindex/rx_stamp fields shared by the op. Add op->if_detected to track the first interface that delivers a matching frame while a timeout/throttle timer is configured, and reject frames from any other interface for that op. The claim is decided in bcm_rx_handler() before hrtimer_cancel() touches op->timer, so a rejected frame can never disturb the claimed interface's watchdog. RTR-mode ops are excluded via RX_RTR_FRAME, independent of kt_ival1/kt_ival2, since those may briefly hold a stale value from an earlier non-RTR configuration. The claim is released in bcm_notify() on NETDEV_UNREGISTER and in bcm_rx_setup() when SETTIMER reconfigures the timer values. A (re-)claim is only possible on CAN devices in NETREG_REGISTERED dev->reg_state to cover the release in bcm_notify() where reg_state becomes NETREG_UNREGISTERING until synchronize_net().
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 2.6.25版本存在安全漏洞，该漏洞源于can: bcm模块的ANYDEV接收操作在多个接口同时到达匹配帧时存在竞争条件，可能导致错误的RX_TIMEOUT通知和last_frames数据损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux ffd980f976e7fd666c2e61bf8ab35107efd11828 ~ f147f48837cb1426521f5b3c3b3134c71128a25d -
Linux Linux 2.6.25 -

II. Public POCs for CVE-2026-72115

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-72115

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-72115 (8)

Same Patch Batch · Linux · 2026-08-15 · 845 CVEs total

CVE-2026-74475 10.0 CRITICAL vxlan: use neigh_ha_snapshot() in route_shortcircuit()
CVE-2026-74280 10.0 CRITICAL crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
CVE-2026-72407 10.0 CRITICAL geneve: validate inner network offset in geneve_gro_complete()
CVE-2026-72408 10.0 CRITICAL geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
CVE-2026-72421 10.0 CRITICAL ipv4: fib: Don't ignore error route in local/main tables.
CVE-2026-74309 10.0 CRITICAL vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
CVE-2026-74279 10.0 CRITICAL crypto: cavium/cpt - fix DMA cleanup using wrong loop index
CVE-2026-72493 9.9 CRITICAL net: serialize netif_running() check in enqueue_to_backlog()
CVE-2026-72381 9.8 CRITICAL ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
CVE-2026-72393 9.8 CRITICAL eth: fbnic: don't cache shinfo across skb realloc
CVE-2026-74401 9.8 CRITICAL dlm: fix add msg handle in send_queue ordered
CVE-2026-74406 9.8 CRITICAL vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
CVE-2026-72355 9.8 CRITICAL netfs: Fix barriering when walking subrequest list
CVE-2026-72339 9.8 CRITICAL qede: fix off-by-one in BD ring consumption on build_skb failure
CVE-2026-72211 9.8 CRITICAL ntfs: grow index root value before reparent header update
CVE-2026-72194 9.8 CRITICAL fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow
CVE-2026-72351 9.8 CRITICAL gue: validate REMCSUM private option length
CVE-2026-72366 9.8 CRITICAL netfs: Fix netfs_create_write_req() to handle async cache object creation
CVE-2026-72098 9.8 CRITICAL dm-verity: fix buffer overflow in FEC calculation
CVE-2026-72083 9.8 CRITICAL scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE

Showing top 20 of 845 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-72115

No comments yet

Leave a comment