Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-72121— can: bcm: add locking when updating filter and timer values

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.15版本存在安全漏洞，该漏洞源于can bcm模块在更新过滤器和定时器值时缺少锁定，导致并发访问时存在竞争条件，可能导致数据被覆盖或状态不一致。

CVSS 8.8 · High EPSS 0.34% · P27

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 27

VendorProduct Version RangeStatus
Linux Linux 7595de7bc56e0e52b74e56c90f7e247bf626d628< 96994180bd7b248b0cc698afe926e23fc1bda59b affected
fbd8fdc2b218e979cfe422b139b8f74c12419d1f< caa8704a7f3cb7806331596195385437126ecb3a affected
2a437b86ac5a9893c902f30ef66815bf13587bf6< a7c369e7da8203e2b5be12bbcac7b9ab2ed5b658 affected
76c84c3728178b2d38d5604e399dfe8b0752645e< a7eb6db1cd3f7b556a301dc1265945ad112089f7 affected
cc55dd28c20a6611e30596019b3b2f636819a4c0< 834cbca3b12e46887f7a9b35f1981a888360ea4c affected
c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7< 19b1994069dd29478ba767de1f98f14a088198dc affected
c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7< fc9f5ee1b073bd233d9c604e338af4ebb42cbc33 affected
c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7< 749179c2e25b95d22499ed29096b3e02d6dfd2b4 affected
… +19 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-72121

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
can: bcm: add locking when updating filter and timer values
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and timer values KCSAN detected a simultaneous access to timer values that can be overwritten in bcm_rx_setup() when updating timer and filter content while bcm_rx_handler(), bcm_rx_timeout_handler() or bcm_rx_thr_handler() run concurrently on incoming CAN traffic. Protect the timer (ival1/ival2/kt_ival1/kt_ival2/kt_lastmsg) and filter (nframes/flags/frames/last_frames) updates in bcm_rx_setup() with a new per-op bcm_rx_update_lock, taken with the matching scope in the RX handlers. memcpy_from_msg() is staged into a temporary buffer before the lock is taken, since it can sleep and must not run under a spinlock. hrtimer_cancel() is always called without bcm_rx_update_lock held, since bcm_rx_timeout_handler()/bcm_rx_thr_handler() take the same lock and a running callback would otherwise deadlock against the canceller. Also close a related race: bcm_rx_setup() cleared the RTR flag in the stored reply frame's can_id as a separate, unprotected step after the frame content was already installed, so a concurrent bcm_rx_handler() could transmit a stale reply with CAN_RTR_FLAG still set. Fold that normalization into the initial frame preparation instead (on the staged buffer for updates, directly on op->frames pre-registration for new ops), so the installed frame is always atomically self-consistent. bcm_rx_handler()'s RX_RTR_FRAME check now takes a lock-protected snapshot of op->flags before deciding whether to call bcm_can_tx(), but does not hold the lock across that call. Also take a lock-protected snapshot of the currframe in bcm_can_tx() to avoid partly overwrites by content updates in bcm_tx_setup(). Finally check if a TX_RESET_MULTI_IDX/SETTIMER might have reset op->currframe between the two locked sections in bcm_can_tx(). Omit calling hrtimer_forward() with zero interval in bcm_rx_thr_handler(). kt_ival2 may have been concurrently cleared by bcm_rx_setup() before it cancels this timer, so check kt_ival2 inside the bcm_rx_update_lock.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.15版本存在安全漏洞，该漏洞源于can bcm模块在更新过滤器和定时器值时缺少锁定，导致并发访问时存在竞争条件，可能导致数据被覆盖或状态不一致。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 7595de7bc56e0e52b74e56c90f7e247bf626d628 ~ 96994180bd7b248b0cc698afe926e23fc1bda59b -
Linux Linux 6.15 -

II. Public POCs for CVE-2026-72121

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-72121

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-72121 (6)

Same Patch Batch · Linux · 2026-08-15 · 845 CVEs total

CVE-2026-72407 10.0 CRITICAL geneve: validate inner network offset in geneve_gro_complete()
CVE-2026-72408 10.0 CRITICAL geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
CVE-2026-74475 10.0 CRITICAL vxlan: use neigh_ha_snapshot() in route_shortcircuit()
CVE-2026-74279 10.0 CRITICAL crypto: cavium/cpt - fix DMA cleanup using wrong loop index
CVE-2026-74280 10.0 CRITICAL crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
CVE-2026-72421 10.0 CRITICAL ipv4: fib: Don't ignore error route in local/main tables.
CVE-2026-74309 10.0 CRITICAL vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
CVE-2026-72493 9.9 CRITICAL net: serialize netif_running() check in enqueue_to_backlog()
CVE-2026-74376 9.8 CRITICAL md/raid10: reset read_slot when reusing r10bio for discard
CVE-2026-74433 9.8 CRITICAL rxrpc: Fix UAF in rxgk_issue_challenge()
CVE-2026-74434 9.8 CRITICAL rxrpc: Don't move a peeked OOB message onto the pending queue
CVE-2026-72191 9.8 CRITICAL ntfs3: validate split-point offset in indx_insert_into_buffer
CVE-2026-72299 9.8 CRITICAL tipc: restrict socket queue dumps in enqueue tracepoints
CVE-2026-72398 9.8 CRITICAL sctp: add INIT verification after cookie unpacking
CVE-2026-74384 9.8 CRITICAL nvme-multipath: fix flex array size in struct nvme_ns_head
CVE-2026-72442 9.8 CRITICAL netfilter: flowtable: fix and simplify IP6IP6 tunnel handling
CVE-2026-74436 9.8 CRITICAL rxrpc: serialize kernel accept preallocation with socket teardown
CVE-2026-74545 9.8 CRITICAL rtase: fix double free of multi-frag skb on DMA map failure
CVE-2026-72046 9.8 CRITICAL gve: fix header buffer corruption with header-split and HW-GRO
CVE-2026-72473 9.8 CRITICAL xprtrdma: Decouple req recycling from RPC completion

Showing top 20 of 845 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-72121

No comments yet

Leave a comment