UBUNTU-CVE-2026-72124

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rxlock The TX state machine so-tx.state is driven from three contexts: sendmsg claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and two...

CVE-2026-72119

In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcmtxlock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc'd buffer and validate it there, mirroring the approach already used in bcmrxsetup. Only copy the validat...

CVE-2026-72117

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix data race on rxstamp/rxifindex in bcmrxhandler For an rx op subscribed on all interfaces ifindex == 0, the same op is registered once in the shared per-netns wildcard filter list, so bcmrxhandler can run concurrentl...

UBUNTU-CVE-2026-72121

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and timer values KCSAN detected a simultaneous access to timer values that can be overwritten in bcmrxsetup when updating timer and filter content while bcmrxhandler, bcmrxtimeouthandler...

UBUNTU-CVE-2026-72123

In the Linux kernel, the following vulnerability has been resolved: can: bcm: defer rxop deallocation to workqueue to fix thrtimer UAF Commit f1b4e32aca08 "can: bcm: use callrcu instead of costly synchronizercu" replaced synchronizercu in bcmdeleterxop with callrcu and introduced the RXNOAUTOTIME...

CVE-2026-72123

In the Linux kernel, the following vulnerability has been resolved: can: bcm: defer rxop deallocation to workqueue to fix thrtimer UAF Commit f1b4e32aca08 "can: bcm: use callrcu instead of costly synchronizercu" replaced synchronizercu in bcmdeleterxop with callrcu and introduced the RXNOAUTOTIME...

CVE-2026-72126

The CVE concerns a Linux kernel race in the isotp path of CAN networking. The fix makes isotp_release() always call synchronize_rcu() before cancelling RX timers, regardless of so->bound, addressing a scenario where NETDEV_UNREGISTER could allow a use-after-free of a timer callback if an in-fl...

CVE-2026-72126 can: isotp: use unconditional synchronize_rcu() in isotp_release()

In the Linux kernel, the following vulnerability has been resolved: can: isotp: use unconditional synchronizercu in isotprelease isotpnotify unregisters the RCU CAN filters via canrxunregister and clears so-bound without waiting for a grace period. isotprelease uses so-bound to decide whether it...

EUVD-2026-58883

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix use-after-free race with concurrent NETDEVUNREGISTER isotprelease looked up the bound network device via devgetbyindex using the stored ifindex. During device unregistration the device is unlisted from the ifindex...

CVE-2026-72125 can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix use-after-free race with concurrent NETDEVUNREGISTER isotprelease looked up the bound network device via devgetbyindex using the stored ifindex. During device unregistration the device is unlisted from the ifindex...

CVE-2026-72124 can: isotp: serialize TX state transitions under so->rx_lock

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rxlock The TX state machine so-tx.state is driven from three contexts: sendmsg claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and two...

CVE-2026-72124

Summary: CVE-2026-72124 affects the Linux kernel CAN isotp TX state machine. The bug arose from mixing a lock-free cmpxchg() claim in sendmsg() with hrtimer_cancel() under so->rx_lock, creating windows where a frame or timer callback could operate on a migrated TX state and corrupt an unrelate...

EUVD-2026-58881

In the Linux kernel, the following vulnerability has been resolved: can: bcm: defer rxop deallocation to workqueue to fix thrtimer UAF Commit f1b4e32aca08 "can: bcm: use callrcu instead of costly synchronizercu" replaced synchronizercu in bcmdeleterxop with callrcu and introduced the RXNOAUTOTIME...

CVE-2026-72123

CVE-2026-72123 concerns Linux kernel CAN BCM RX teardown where a race between a concurrent RCU reader and a deferred thrtimer could dereference a freed op, causing a use-after-free. Root cause: after replacing synchronize_rcu() with call_rcu() and introducing RX_NO_AUTOTIMER, the thrtimer path in...

CVE-2026-72123 can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF

In the Linux kernel, the following vulnerability has been resolved: can: bcm: defer rxop deallocation to workqueue to fix thrtimer UAF Commit f1b4e32aca08 "can: bcm: use callrcu instead of costly synchronizercu" replaced synchronizercu in bcmdeleterxop with callrcu and introduced the RXNOAUTOTIME...

CVE-2026-72122 can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix lockless bound/ifindex race and silent RXSETUP failure bcmsendmsg reads bo-ifindex and checks bo-bound before taking locksock, while bcmnotify, bcmconnect and bcmrelease all mutate both fields under that same lock...

EUVD-2026-58880

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix lockless bound/ifindex race and silent RXSETUP failure bcmsendmsg reads bo-ifindex and checks bo-bound before taking locksock, while bcmnotify, bcmconnect and bcmrelease all mutate both fields under that same lock...

CVE-2026-72120

CVE-2026-72120 affects the Linux kernel bcm subsystem. The issue stems from missing RCU list annotations/operations for bcm_op handling, leading to improper initialization when traversing bcm_op under rcu_read_lock(). Fixes include moving list_add_rcu() calls to the end of bcm_[rx|tx]_setup and U...

CVE-2026-72121 can: bcm: add locking when updating filter and timer values

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and timer values KCSAN detected a simultaneous access to timer values that can be overwritten in bcmrxsetup when updating timer and filter content while bcmrxhandler, bcmrxtimeouthandler...

CVE-2026-72121

CVE-2026-72121 describes a Linux kernel CAN subsystem vulnerability in which KCSAN detected a race condition updating timer and filter state during CAN message handling. The fix introduces a per-operation bcm_rx_update_lock to serialize updates to timer values (ival1/ival2/kt_ival1/kt_ival2/kt_la...