CVE-2026-72120

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the CAN BCM module where missing RCU (Read-Copy-Update) list annotations and operations lead to improper initialization and removal of structures. Specifically, the bcm [rx|tx] setup() functions failed to use list add rcu(), which could result in an improperly initialized bcm op structure when bcm proc show() traverses these structures under rcu read lock(). Additionally, bcm release() called bcm remove op() to free operations via call rcu() while they were still linked in bo->tx ops or bo->rx ops without first calling list del rcu(). RCU is a synchronization mechanism that allows multiple readers to access data simultaneously while a writer updates it.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.