CVE-2026-74461 i2c: imx: Cancel hrtimer before clearing slave pointer

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2cimxunregslave, the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer i2cimxslavetimeout befor...

CVE-2026-74461

CVE-2026-74461 affects the Linux kernel i2c_imx path. The bug occurs in i2c_imx_unreg_slave(): the slave pointer is set to NULL after disabling interrupts, which can allow a pending hrtimer (i2c_imx_slave_timeout) to fire and call i2c_imx_slave_finish_op(), passing a NULL slave pointer and causin...

EUVD-2026-59654

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2cimxunregslave, the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer i2cimxslavetimeout befor...

CVE-2026-74461

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2cimxunregslave, the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer i2cimxslavetimeout befor...

CVE-2026-72123

In the Linux kernel, the following vulnerability has been resolved: can: bcm: defer rxop deallocation to workqueue to fix thrtimer UAF Commit f1b4e32aca08 "can: bcm: use callrcu instead of costly synchronizercu" replaced synchronizercu in bcmdeleterxop with callrcu and introduced the RXNOAUTOTIME...

CVE-2026-72124

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rxlock The TX state machine so-tx.state is driven from three contexts: sendmsg claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and two...

CVE-2026-72116

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix stale rx/tx ops after device removal RX: an RXSETUP update! for an existing op skipped canrxregister unconditionally, even when a concurrent NETDEVUNREGISTER had already torn down its registration op-rxregdev == NUL...

CVE-2026-72115

In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for ANYDEV timeout/throttle ops An ANYDEV rx op ifindex == 0 with an active RX timeout and/or throttle timer has no defined semantics when matching frames arrive from several interfaces:...

EUVD-2026-58882

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rxlock The TX state machine so-tx.state is driven from three contexts: sendmsg claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and two...

CVE-2026-72124

CVE-2026-72124 relates to the Linux kernel’s isotp (CAN ISO-TP) implementation. A race in the TX state machine (so->tx.state) could occur when combining a lock-free cmpxchg() claim in sendmsg() with hrtimer_cancel() calls under so->rx_lock, allowing a frame or timer callback to observe a tr...

CVE-2026-72124 can: isotp: serialize TX state transitions under so->rx_lock

In the Linux kernel, the following vulnerability has been resolved: can: isotp: serialize TX state transitions under so-rxlock The TX state machine so-tx.state is driven from three contexts: sendmsg claiming and progressing a transfer, the RX path consuming Flow Control/echo frames, and two...

CVE-2026-72123

In CVE-2026-72123, the Linux kernel BCM CAN path was hardened by deferring rx_op deallocation and timer cancellation to a workqueue (bcm_wq) to avoid thrtimer UAF. The fix replaces synchronize_rcu() with call_rcu() in bcm_delete_rx_op() and introduces the RX_NO_AUTOTIMER flag, but a TOCTOU remain...

CVE-2026-72121

The CVE pertains to the Linux kernel CAN subsystem (bcm) where a KCSAN race allowed simultaneous access to timer and filter state during CAN traffic. The fix adds a per-op bcm_rx_update_lock to guard updates to timer values (ival1/ival2/kt_ival1/kt_ival2/kt_lastmsg) and filter data (nframes/flags...

EUVD-2026-59074

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix stale rx/tx ops after device removal RX: an RXSETUP update! for an existing op skipped canrxregister unconditionally, even when a concurrent NETDEVUNREGISTER had already torn down its registration op-rxregdev == NUL...

CVE-2026-72116 can: bcm: fix stale rx/tx ops after device removal

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix stale rx/tx ops after device removal RX: an RXSETUP update! for an existing op skipped canrxregister unconditionally, even when a concurrent NETDEVUNREGISTER had already torn down its registration op-rxregdev == NUL...

CVE-2026-72116

CVE-2026-72116 affects the Linux kernel BCM CAN subsystem. In RX, an RX_SETUP update could skip can_rx_register() after NETDEV_UNREGISTER, leaving rx_ops with ifindex 0 and not re-enabling frame delivery; bcm_rx_setup() now re-registers in that case. In TX, bcm_notify() only updated bo->rx_ops...

EUVD-2026-59073

In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for ANYDEV timeout/throttle ops An ANYDEV rx op ifindex == 0 with an active RX timeout and/or throttle timer has no defined semantics when matching frames arrive from several interfaces:...

CVE-2026-72115

CVE-2026-72115 – Linux kernel (CAN BCM) Concretely, a race in the can: bcm driver: when an ANYDEV RX op (ifindex == 0) has active timeout/throttle timers, bcm_rx_handler() can run concurrently on multiple CPUs and race with hrtimer_cancel/bcm_rx_starttimer against bcm_rx_timeout_handler(), causin...

CVE-2026-72115 can: bcm: track a single source interface for ANYDEV timeout/throttle ops

In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for ANYDEV timeout/throttle ops An ANYDEV rx op ifindex == 0 with an active RX timeout and/or throttle timer has no defined semantics when matching frames arrive from several interfaces:...

PT-2026-72305

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix stale rx/tx ops after device removal RX: an RX SETUP update! for an existing op skipped can rx register unconditionally, even when a concurrent NETDEV UNREGISTER had already torn down its registration op-rx reg dev ...