CVE-2026-72121

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the CAN BCM module where simultaneous access to timer and filter values can occur. Specifically, bcm rx setup() can overwrite values while bcm rx handler(), bcm rx timeout handler(), or bcm rx thr handler() are running concurrently on incoming CAN traffic. This issue affects timer variables ival1, ival2, kt ival1, kt ival2, and kt lastmsg, as well as filter variables nframes, flags, frames, and last frames.

Additionally, a race condition in bcm rx setup() could allow bcm rx handler() to transmit a stale reply with the CAN RTR FLAG still set because the RTR flag in the stored reply frame's can id was cleared as a separate, unprotected step. The issue also involves potential partial overwrites of currframe in bcm can tx() by content updates in bcm tx setup().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.