CVE-2026-72125

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free race condition exists in the ISO Transport (IsoTP) protocol implementation. The isotp release() function attempts to look up a bound network device using dev get by index() and the ifindex variable. During device unregistration, the device is removed from the ifindex hash before the NETDEV UNREGISTER notifier chain executes. This allows a concurrent isotp release() to fail to find the device, skip the can rx unregister() function, and proceed to free the socket. Because the process removes itself from the isotp notifier list, isotp notify() cannot perform cleanup, resulting in a stale CAN filter that references the freed socket memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.