CVE-2026-72116 can: bcm: fix stale rx/tx ops after device removal

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix stale rx/tx ops after device removal RX: an RXSETUP update! for an existing op skipped canrxregister unconditionally, even when a concurrent NETDEVUNREGISTER had already torn down its registration op-rxregdev == NUL...

CVE-2026-72116

The CVE-2026-72116 entry describes a Linux kernel issue in the CAN networking path (bcm) where stale RX/TX operation references could occur after device removal. RX: an RX_SETUP update could skip can_rx_register() if NETDEV_UNREGISTER occurred, leaving rx_ops with ifindex=0 and not re-enabling fr...

CVE-2026-72117 can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix data race on rxstamp/rxifindex in bcmrxhandler For an rx op subscribed on all interfaces ifindex == 0, the same op is registered once in the shared per-netns wildcard filter list, so bcmrxhandler can run concurrentl...

CVE-2026-72115

The CVE-2026-72115 issue affects the Linux kernel CAN BCM RX path. A race between bcm_rx_handler(), hrtimer_cancel(), bcm_rx_starttimer(), and bcm_rx_timeout_handler() could allow an ANYDEV operation (ifindex == 0) to process frames from multiple interfaces, causing spurious RX_TIMEOUT events and...

CVE-2026-72115 can: bcm: track a single source interface for ANYDEV timeout/throttle ops

In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for ANYDEV timeout/throttle ops An ANYDEV rx op ifindex == 0 with an active RX timeout and/or throttle timer has no defined semantics when matching frames arrive from several interfaces:...

CVE-2026-72115 can: bcm: track a single source interface for ANYDEV timeout/throttle ops

In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for ANYDEV timeout/throttle ops An ANYDEV rx op ifindex == 0 with an active RX timeout and/or throttle timer has no defined semantics when matching frames arrive from several interfaces:...

CVE-2026-72113

Technical details are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2026-72114 can: bcm: validate frame length in bcm_rx_setup() for RTR replies

In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcmrxsetup for RTR replies bcmtxsetup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TXSETUP, but bcmrxsetup never did the same for the RTR-reply frame configure...

CVE-2026-72114

In the Linux kernel CAN BCM subsystem, CVE-2026-72114 is due to bcm_rx_setup() not validating the frame length for RTR-reply frames configured via RX_SETUP with RX_RTR_FRAME, unlike bcm_tx_setup() which validates cf->len against CAN/CAN FD DLC limits. The vulnerability is resolved by adding va...

Linux Distros Unpatched Vulnerability : CVE-2026-72119

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: bcm: extend bcmtxlock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc'd buffer and validate it there,...

PT-2026-72306

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix data race on rx stamp/rx ifindex in bcm rx handler For an rx op subscribed on all interfaces ifindex == 0, the same op is registered once in the shared per-netns wildcard filter list, so bcm rx handler can run...

Linux Distros Unpatched Vulnerability : CVE-2026-72115

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: bcm: track a single source interface for ANYDEV timeout/throttle ops An ANYDEV rx op ifindex == 0 with an active RX timeout and/or throttle timer has no...

DEBIAN-CVE-2026-17523

In the Linux kernel, the following vulnerability has been resolved: can: bcm: switch timer to HRTIMERMODESOFT and remove hrtimertasklet This patch switches the timer to HRTIMERMODESOFT, which executed the timer callback in softirq context and removes the hrtimertasklet...

CVE-2026-17523

In the Linux kernel, the following vulnerability has been resolved: can: bcm: switch timer to HRTIMERMODESOFT and remove hrtimertasklet This patch switches the timer to HRTIMERMODESOFT, which executed the timer callback in softirq context and removes the hrtimertasklet...

CVE-2026-17523 can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet

In the Linux kernel, the following vulnerability has been resolved: can: bcm: switch timer to HRTIMERMODESOFT and remove hrtimertasklet This patch switches the timer to HRTIMERMODESOFT, which executed the timer callback in softirq context and removes the hrtimertasklet...

CVE-2026-17523

In the Linux kernel, the following vulnerability has been resolved: can: bcm: switch timer to HRTIMERMODESOFT and remove hrtimertasklet This patch switches the timer to HRTIMERMODESOFT, which executed the timer callback in softirq context and removes the hrtimertasklet...

PT-2026-72312

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the BCM CAN driver. During the teardown of a BCM RX operation, a race condition occurs where a concurrent RCU reader bcm rx handler can re-arm a...

EulerOS 2.0 SP15 : kernel (EulerOS-SA-2026-2444)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : crypto: algifaead - Revert to operating out-of-placeCVE-2026-31431 bpf: Fix undefined behavior in interpreter sdiv/smod for INTMINCVE-2026-31525...

ROS-20260211-73-0004

A vulnerability in the net/can/bcm.c component of the Linux kernel is related to the use of memory after it has been freed. Exploitation of the vulnerability may allow an attacker to gain access to confidential data, violate its integrity, and cause denial of service...

ROS-20260205-73-0001

A vulnerability in the net/can/bcm.c component of the Linux operating system kernel is related to reading outside the allowed data buffer boundaries. Exploitation of the vulnerability may allow an attacker to gain access to sensitive data and also cause a denial of service...