CVE-2026-72123

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Use-After-Free (UAF) issue exists in the BCM CAN driver. During the teardown of a BCM RX operation, a race condition occurs where a concurrent RCU reader bcm rx handler can re-arm a thrtimer via the bcm rx update and send() function after call rcu() has been scheduled. When the RCU grace period ends, the bcm op is freed, but the subsequently firing thrtimer dereferences this deallocated memory. This is caused by a missing flag check for the thrtimer in the packet RX fast-path, leading to a Time-of-Check to Time-of-Use (TOCTOU) race. Additionally, the bcm send to user() function may dereference op->sk if the socket is freed while a timer is still armed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.