can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-72123
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-15 06:21:29 UTC
Updated2026-08-19 17:20:59 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF Commit f1b4e32aca08 ("can: bcm: use call_rcu() instead of costly synchronize_rcu()") replaced synchronize_rcu() in bcm_delete_rx_op() with call_rcu() and introduced the RX_NO_AUTOTIMER flag. However, this flag check was omitted for thrtimer in the packet rx fast-path. During BCM RX operation teardown, a concurrent RCU reader (bcm_rx_handler) can race and re-arm thrtimer via bcm_rx_update_and_send() after call_rcu() has been scheduled. Once the RCU grace period elapses, bcm_op is freed. The subsequently firing thrtimer then dereferences the deallocated op, causing a UAF. Adding flag checks to the rx fast-path (bcm_rx_update_and_send) does not fully close the TOCTOU race and introduces latency for every CAN frame. Conversely, calling hrtimer_cancel() directly inside the RCU callback (softirq context) is fatal as hrtimer_cancel() can sleep, triggering a "scheduling while atomic" panic. Resolve this by deferring the timer cancellation and memory free to a dedicated unbound workqueue (bcm_wq). The RCU callback now queues a work item to bcm_wq, which safely cancels both timers and deallocates memory in sleepable process context. A dedicated workqueue is used to prevent system-wide WQ saturation and is cleanly flushed/destroyed on module unload to avoid rmmod page faults. Since the deferred work can now outlive the calling context by an unbounded amount, also take a reference on op->sk when it is assigned and drop it only once the deferred work has cancelled both timers, so a socket can no longer be freed out from under a still-armed timer whose callback (bcm_send_to_user()) dereferences op->sk.

Risk And Classification

Primary CVSS: v3.1 7.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.001640000 probability, percentile 0.061170000 (date 2026-08-19)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 85cd41070df992d3c0dfd828866fdd243d3b774a de5fce46637de05bef56ec08528127676eb6fc9b git Not specified
CNA Linux Linux affected f34f2a18e47b73e48f90a757e1f4aaa8c7d665a1 036a8c320ca11bc912e8027adcfad14b326f067e git Not specified
CNA Linux Linux affected f1b4e32aca0811aa011c76e5d6cf2fa19224b386 3cf4fd5316f449811d8baf1bc6978ef5a7b743a9 git Not specified
CNA Linux Linux affected f1b4e32aca0811aa011c76e5d6cf2fa19224b386 4177762f70646ac48a2af382e45a795cbd295198 git Not specified
CNA Linux Linux affected f1b4e32aca0811aa011c76e5d6cf2fa19224b386 6fd08e8d826c3aa4cc7021f5f9cdbb7fa7441d3f git Not specified
CNA Linux Linux affected f1b4e32aca0811aa011c76e5d6cf2fa19224b386 cd830e0bc25ee2d38cbfbdbb3cd77c5f53b2b6d5 git Not specified
CNA Linux Linux affected f1b4e32aca0811aa011c76e5d6cf2fa19224b386 ce2d4b121fb7545e1ed588e860c8e5fd5ad45224 git Not specified
CNA Linux Linux affected f1b4e32aca0811aa011c76e5d6cf2fa19224b386 68973f9db76144825e4f35dfdc80fb8279eb2d57 git Not specified
CNA Linux Linux affected fbac09a3b8890003c0c55294c00709f3ae5501bb git Not specified
CNA Linux Linux affected 5b48f5711f1c630841ab78dcc061de902f0e37bf git Not specified
CNA Linux Linux affected edb4baffb9483141a50fb7f7146cfe4a4c0c2db8 git Not specified
CNA Linux Linux affected 5.10.130 5.10.265 semver Not specified
CNA Linux Linux affected 5.15.54 5.15.216 semver Not specified
CNA Linux Linux affected 4.19.252 4.20 semver Not specified
CNA Linux Linux affected 5.4.205 5.5 semver Not specified
CNA Linux Linux affected 5.18.11 5.19 semver Not specified
CNA Linux Linux affected 5.19 Not specified
CNA Linux Linux unaffected 5.19 semver Not specified
CNA Linux Linux unaffected 5.10.265 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.216 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.178 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.145 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.97 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.40 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.5 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/cd830e0bc25ee2d38cbfbdbb3cd77c5f53b2b6d5 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/036a8c320ca11bc912e8027adcfad14b326f067e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/68973f9db76144825e4f35dfdc80fb8279eb2d57 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/de5fce46637de05bef56ec08528127676eb6fc9b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3cf4fd5316f449811d8baf1bc6978ef5a7b743a9 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/6fd08e8d826c3aa4cc7021f5f9cdbb7fa7441d3f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ce2d4b121fb7545e1ed588e860c8e5fd5ad45224 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/4177762f70646ac48a2af382e45a795cbd295198 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report