CVE-2026-72113

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the CAN bcm module where a missing device reference count during CAN filter removal can lead to a stale filter. The functions bcm release(), bcm delete rx op(), and bcm notifier() use dev get by index(ifindex) to locate the device before unregistering its filter. If a concurrent NETDEV UNREGISTER event removes the device from the index table, the lookup fails and can rx unregister() is skipped. This results in a stale CAN filter that points to a bcm op or socket that is about to be freed. The issue is resolved by maintaining a tracked reference on op->rx reg dev using netdev hold() and netdev put() from the time the filter is registered in bcm rx setup() until it is unregistered in bcm rx unreg().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.