UBUNTU-CVE-2026-72124

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rxlock The TX state machine so-tx.state is driven from three contexts: sendmsg claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and two...

UBUNTU-CVE-2026-72113

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing device refcount for CAN filter removal sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is present in the bcm.c code. A former fix for raw.c commit c275a176e4b6...

CVE-2026-72124 can: isotp: serialize TX state transitions under so->rx_lock

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rxlock The TX state machine so-tx.state is driven from three contexts: sendmsg claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and two...

CVE-2026-72121 can: bcm: add locking when updating filter and timer values

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and timer values KCSAN detected a simultaneous access to timer values that can be overwritten in bcmrxsetup when updating timer and filter content while bcmrxhandler, bcmrxtimeouthandler...

CVE-2026-72119 can: bcm: extend bcm_tx_lock usage for data and timer updates

In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcmtxlock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc'd buffer and validate it there, mirroring the approach already used in bcmrxsetup. Only copy the validat...

CVE-2026-72118 can: bcm: fix CAN frame rx/tx statistics

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix CAN frame rx/tx statistics KCSAN detected a data race within the bcmrxhandler when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs. Use atomic operations with...

CVE-2026-72118 can: bcm: fix CAN frame rx/tx statistics

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix CAN frame rx/tx statistics KCSAN detected a data race within the bcmrxhandler when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs. Use atomic operations with...

CVE-2026-72116 can: bcm: fix stale rx/tx ops after device removal

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix stale rx/tx ops after device removal RX: an RXSETUP update! for an existing op skipped canrxregister unconditionally, even when a concurrent NETDEVUNREGISTER had already torn down its registration op-rxregdev == NUL...

Linux Distros Unpatched Vulnerability : CVE-2026-74457

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: peakusb: add bounds check for USB channel index The channel control index ctrlidx is derived from rx-len which comes directly from a device USB payload. Th...

PT-2026-72302

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the CAN bcm module where a missing device reference count during CAN filter removal can lead to a stale filter. The functions bcm release, bcm delete rx op, and bcm...

PT-2026-72912

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ems usb read bulk callback function where CPC CAN Protocol Control messages packed in a USB receive buffer are not properly validated. The function fails to verify...

Linux Distros Unpatched Vulnerability : CVE-2026-72118

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: bcm: fix CAN frame rx/tx statistics KCSAN detected a data race within the bcmrxhandler when two CAN frames have been simultaneously received and processed ...

Linux Distros Unpatched Vulnerability : CVE-2026-72121

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: bcm: add locking when updating filter and timer values KCSAN detected a simultaneous access to timer values that can be overwritten in bcmrxsetup when...

Linux Distros Unpatched Vulnerability : CVE-2026-72114

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: bcm: validate frame length in bcmrxsetup for RTR replies bcmtxsetup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TXSETUP...

PT-2026-72909

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the peak usb component where the channel control index ctrl idx is derived from rx-len, which is sourced directly from a device USB payload. While a mask allows values...

PT-2026-72910

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the can: kvaser usb leaf module where the wait and bulk receive paths process variable-length commands from a USB buffer. A nonzero command shorter than CMD HEADER LEN...

Linux Distros Unpatched Vulnerability : CVE-2026-72113

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: bcm: add missing device refcount for CAN filter removal sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is...

Linux kernel module CAN usb kvaser_usb_leaf Buffer Overflow DoS

The vulnerabilities of the functions kvaserusbleafwaitcmd and kvaserusbleafreadbulkcallback in the driver/net/can/usb/kvaserusb/kvaserusbleaf.c file of the Linux kernel are related to the execution of a loop with an unreachable exit condition. Exploiting these vulnerabilities could allow an...

Exploit for CVE-2026-21014

--- CVE-2026-21014 – CAN Bus Frame Replay Attack on Automoti...

CVE-2026-49316: Expected Behavior Violation

Expected behavior violation in the in-vehicle network of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the motorcycle's anti-theft shutdown by forcing the Wireless Control Module WCM into the CAN bus-off state. Using a well-known CAN...