{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72115", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.906Z", "datePublished": "2026-08-15T05:52:55.524Z", "dateUpdated": "2026-08-19T16:36:03.316Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:36:03.316Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: track a single source interface for ANYDEV timeout/throttle ops\n\nAn ANYDEV rx op (ifindex == 0) with an active RX timeout and/or\nthrottle timer has no defined semantics when matching frames arrive\nfrom several interfaces: bcm_rx_handler() can run concurrently for\nthe same op on different CPUs, racing hrtimer_cancel()/\nbcm_rx_starttimer() against bcm_rx_timeout_handler() and causing\nspurious RX_TIMEOUT notifications and last_frames corruption. The\nsame concurrency lets throttled multiplex frames from different\ninterfaces clobber the single rx_ifindex/rx_stamp fields shared by\nthe op.\n\nAdd op->if_detected to track the first interface that delivers a\nmatching frame while a timeout/throttle timer is configured, and\nreject frames from any other interface for that op. The claim is\ndecided in bcm_rx_handler() before hrtimer_cancel() touches\nop->timer, so a rejected frame can never disturb the claimed\ninterface's watchdog. RTR-mode ops are excluded via RX_RTR_FRAME,\nindependent of kt_ival1/kt_ival2, since those may briefly hold a\nstale value from an earlier non-RTR configuration.\n\nThe claim is released in bcm_notify() on NETDEV_UNREGISTER and in\nbcm_rx_setup() when SETTIMER reconfigures the timer values.\n\nA (re-)claim is only possible on CAN devices in NETREG_REGISTERED\ndev->reg_state to cover the release in bcm_notify() where reg_state\nbecomes NETREG_UNREGISTERING until synchronize_net()."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 8.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - bcm_rx_handler() is reached from the CAN driver RX path when matching frames arrive on multiple interfaces; on automotive/industrial systems an attacker on shared CAN segment(s) can inject concurrent frames without host shell access once an ANYDEV BCM RX op with active timeout/throttle timers exists.\nAC:L - The attacker controls both sides of the race by flooding matching frames on multiple CAN interfaces (or paired vcan devices) to run bcm_rx_handler() concurrently on different CPUs, racing hrtimer_cancel/bcm_rx_starttimer against bcm_rx_timeout_handler and interleaved last_frames writers.\nPR:N - No Linux capability or account is required to deliver triggering CAN traffic on multiple interfaces; bcm_rx_handler() runs from the unauthenticated netdev RX path once any ANYDEV BCM RX op with active kt_ival1/kt_ival2 timers exists, as commonly configured by telematics/diagnostic daemons.\nUI:N - Exploitation requires no victim interaction beyond normal system operation; malicious or concurrent CAN frames are processed automatically in softirq without mounts, file opens, or user prompts.\nS:U - Impact is confined to corrupted BCM state and incorrect CAN notifications delivered to the subscribing userspace process within the same kernel/host security boundary; no VM, container, or IOMMU escape is involved.\nC:H - Concurrent bcm_rx_handler() and bcm_rx_timeout_handler() races corrupt op->last_frames heap buffers via unsynchronized memcpy/memset, mixing attacker-controlled CAN payloads from different interfaces and leaking cross-bus frame content through bcm_send_to_user().\nI:H - last_frames corruption lets attacker-controlled frames from one interface overwrite or interleave with another's stored/throttled state, misattributing RX_CHANGED/RX_TIMEOUT notifications and corrupting safety- or security-relevant CAN monitoring and control decisions.\nA:N - The race corrupts per-op BCM buffers and emits spurious RX_TIMEOUT events but does not dereference freed objects, overrun buffer bounds, or fault the kernel; no oops, panic, hang, or sustained kernel denial of service is indicated."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/can/bcm.c"], "versions": [{"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "f147f48837cb1426521f5b3c3b3134c71128a25d", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "57cf104da4cf450ae9c16801a3164604b801d2cc", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "03dfe347c398fa41a7e30e8dc538f12568c183e6", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "18b45251e74e35668f0dd0c470549384ae191ecf", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "3ff8c24b421070a2db99a5cdb86edc9ff339418e", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "eca8b44d51fc6ab61022258ec968e55e3073b79e", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "b6317022b685a430a3ae420456716e3c0c02ef4b", "status": "affected", "versionType": "git"}, {"version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "lessThan": "2f5976f54a04e9f18b25283036ac3136be453b17", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/can/bcm.c"], "versions": [{"version": "2.6.25", "status": "affected"}, {"version": "0", "lessThan": "2.6.25", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f147f48837cb1426521f5b3c3b3134c71128a25d"}, {"url": "https://git.kernel.org/stable/c/57cf104da4cf450ae9c16801a3164604b801d2cc"}, {"url": "https://git.kernel.org/stable/c/03dfe347c398fa41a7e30e8dc538f12568c183e6"}, {"url": "https://git.kernel.org/stable/c/18b45251e74e35668f0dd0c470549384ae191ecf"}, {"url": "https://git.kernel.org/stable/c/3ff8c24b421070a2db99a5cdb86edc9ff339418e"}, {"url": "https://git.kernel.org/stable/c/eca8b44d51fc6ab61022258ec968e55e3073b79e"}, {"url": "https://git.kernel.org/stable/c/b6317022b685a430a3ae420456716e3c0c02ef4b"}, {"url": "https://git.kernel.org/stable/c/2f5976f54a04e9f18b25283036ac3136be453b17"}], "title": "can: bcm: track a single source interface for ANYDEV timeout/throttle ops", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/can/bcm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f147f48837cb1426521f5b3c3b3134c71128a25d", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "57cf104da4cf450ae9c16801a3164604b801d2cc", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "03dfe347c398fa41a7e30e8dc538f12568c183e6", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "18b45251e74e35668f0dd0c470549384ae191ecf", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "3ff8c24b421070a2db99a5cdb86edc9ff339418e", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "eca8b44d51fc6ab61022258ec968e55e3073b79e", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "b6317022b685a430a3ae420456716e3c0c02ef4b", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}, {"lessThan": "2f5976f54a04e9f18b25283036ac3136be453b17", "status": "affected", "version": "ffd980f976e7fd666c2e61bf8ab35107efd11828", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/can/bcm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.25"}, {"lessThan": "2.6.25", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.148", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: track a single source interface for ANYDEV timeout/throttle ops\n\nAn ANYDEV rx op (ifindex == 0) with an active RX timeout and/or\nthrottle timer has no defined semantics when matching frames arrive\nfrom several interfaces: bcm_rx_handler() can run concurrently for\nthe same op on different CPUs, racing hrtimer_cancel()/\nbcm_rx_starttimer() against bcm_rx_timeout_handler() and causing\nspurious RX_TIMEOUT notifications and last_frames corruption. The\nsame concurrency lets throttled multiplex frames from different\ninterfaces clobber the single rx_ifindex/rx_stamp fields shared by\nthe op.\n\nAdd op->if_detected to track the first interface that delivers a\nmatching frame while a timeout/throttle timer is configured, and\nreject frames from any other interface for that op. The claim is\ndecided in bcm_rx_handler() before hrtimer_cancel() touches\nop->timer, so a rejected frame can never disturb the claimed\ninterface's watchdog. RTR-mode ops are excluded via RX_RTR_FRAME,\nindependent of kt_ival1/kt_ival2, since those may briefly hold a\nstale value from an earlier non-RTR configuration.\n\nThe claim is released in bcm_notify() on NETDEV_UNREGISTER and in\nbcm_rx_setup() when SETTIMER reconfigures the timer values.\n\nA (re-)claim is only possible on CAN devices in NETREG_REGISTERED\ndev->reg_state to cover the release in bcm_notify() where reg_state\nbecomes NETREG_UNREGISTERING until synchronize_net()."}], "id": "CVE-2026-72115", "lastModified": "2026-08-19T17:20:57.797", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:21:25.900", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/03dfe347c398fa41a7e30e8dc538f12568c183e6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/18b45251e74e35668f0dd0c470549384ae191ecf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2f5976f54a04e9f18b25283036ac3136be453b17"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3ff8c24b421070a2db99a5cdb86edc9ff339418e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/57cf104da4cf450ae9c16801a3164604b801d2cc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b6317022b685a430a3ae420456716e3c0c02ef4b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eca8b44d51fc6ab61022258ec968e55e3073b79e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f147f48837cb1426521f5b3c3b3134c71128a25d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: can: bcm: track a single source interface for ANYDEV timeout/throttle ops", "id": "2516402", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516402"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-366", "details": ["A flaw was found in the Linux kernel's Controller Area Network (CAN) Broadcast Manager (BCM) module. A race condition can occur when an ANYDEV receive operation, which listens on all interfaces, has an active timeout or throttle timer and receives matching frames from multiple network interfaces simultaneously. This concurrency can lead to incorrect timeout notifications and corruption of received frame data, potentially resulting in a Denial of Service (DoS) for the CAN bus communication."], "name": "CVE-2026-72115", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72115\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72115\nhttps://lore.kernel.org/linux-cve-announce/2026081527-CVE-2026-72115-ca3c@gregkh/T"], "threat_severity": "Moderate"}