CVE-2026-72122

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the CAN BCM module. The bcm sendmsg() function reads the bo->ifindex variable and checks the bo->bound variable before acquiring the lock sock() lock. Simultaneously, the bcm notify(), bcm connect(), and bcm release() functions modify these same fields while holding the lock. Because these reads and writes are unordered, a concurrent device unregistration or bind operation can cause bcm sendmsg() to observe an inconsistent state, such as a stale bo->bound value combined with a cleared bo->ifindex. This can result in a socket bound to a specific CAN interface being incorrectly treated as matching any interface. Additionally, the bcm rx setup() function may silently return success instead of reporting an error when a target device disappears concurrently.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.