CVE-2026-72115

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the CAN BCM module where an ANYDEV rx operation (where ifindex is 0) with an active RX timeout or throttle timer lacks defined semantics when matching frames arrive from multiple interfaces. This allows the bcm rx handler() function to run concurrently for the same operation on different CPUs, creating a race condition between hrtimer cancel()/bcm rx starttimer() and bcm rx timeout handler(). This concurrency can lead to corruption of last frames and the triggering of spurious RX TIMEOUT notifications. Additionally, throttled multiplex frames from different interfaces may overwrite the shared rx ifindex and rx stamp fields of the operation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.