{"api_version":"1","generated_at":"2026-08-22T05:31:13+00:00","cve":"CVE-2026-72115","urls":{"html":"https://cve.report/CVE-2026-72115","api":"https://cve.report/api/cve/CVE-2026-72115.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-72115","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-72115"},"summary":{"title":"can: bcm: track a single source interface for ANYDEV timeout/throttle ops","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: track a single source interface for ANYDEV timeout/throttle ops\n\nAn ANYDEV rx op (ifindex == 0) with an active RX timeout and/or\nthrottle timer has no defined semantics when matching frames arrive\nfrom several interfaces: bcm_rx_handler() can run concurrently for\nthe same op on different CPUs, racing hrtimer_cancel()/\nbcm_rx_starttimer() against bcm_rx_timeout_handler() and causing\nspurious RX_TIMEOUT notifications and last_frames corruption. The\nsame concurrency lets throttled multiplex frames from different\ninterfaces clobber the single rx_ifindex/rx_stamp fields shared by\nthe op.\n\nAdd op->if_detected to track the first interface that delivers a\nmatching frame while a timeout/throttle timer is configured, and\nreject frames from any other interface for that op. The claim is\ndecided in bcm_rx_handler() before hrtimer_cancel() touches\nop->timer, so a rejected frame can never disturb the claimed\ninterface's watchdog. RTR-mode ops are excluded via RX_RTR_FRAME,\nindependent of kt_ival1/kt_ival2, since those may briefly hold a\nstale value from an earlier non-RTR configuration.\n\nThe claim is released in bcm_notify() on NETDEV_UNREGISTER and in\nbcm_rx_setup() when SETTIMER reconfigures the timer values.\n\nA (re-)claim is only possible on CAN devices in NETREG_REGISTERED\ndev->reg_state to cover the release in bcm_notify() where reg_state\nbecomes NETREG_UNREGISTERING until synchronize_net().","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-15 06:21:25","updated_at":"2026-08-17 06:18:10"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","data":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/18b45251e74e35668f0dd0c470549384ae191ecf","name":"https://git.kernel.org/stable/c/18b45251e74e35668f0dd0c470549384ae191ecf","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b6317022b685a430a3ae420456716e3c0c02ef4b","name":"https://git.kernel.org/stable/c/b6317022b685a430a3ae420456716e3c0c02ef4b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/57cf104da4cf450ae9c16801a3164604b801d2cc","name":"https://git.kernel.org/stable/c/57cf104da4cf450ae9c16801a3164604b801d2cc","refsource":"https://git.kernel.org/stable/c/57cf104da4cf450ae9c16801a3164604b801d2cc","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/03dfe347c398fa41a7e30e8dc538f12568c183e6","name":"https://git.kernel.org/stable/c/03dfe347c398fa41a7e30e8dc538f12568c183e6","refsource":"https://git.kernel.org/stable/c/03dfe347c398fa41a7e30e8dc538f12568c183e6","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2f5976f54a04e9f18b25283036ac3136be453b17","name":"https://git.kernel.org/stable/c/2f5976f54a04e9f18b25283036ac3136be453b17","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f147f48837cb1426521f5b3c3b3134c71128a25d","name":"https://git.kernel.org/stable/c/f147f48837cb1426521f5b3c3b3134c71128a25d","refsource":"https://git.kernel.org/stable/c/f147f48837cb1426521f5b3c3b3134c71128a25d","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3ff8c24b421070a2db99a5cdb86edc9ff339418e","name":"https://git.kernel.org/stable/c/3ff8c24b421070a2db99a5cdb86edc9ff339418e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/eca8b44d51fc6ab61022258ec968e55e3073b79e","name":"https://git.kernel.org/stable/c/eca8b44d51fc6ab61022258ec968e55e3073b79e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72115","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72115","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ffd980f976e7fd666c2e61bf8ab35107efd11828 f147f48837cb1426521f5b3c3b3134c71128a25d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ffd980f976e7fd666c2e61bf8ab35107efd11828 57cf104da4cf450ae9c16801a3164604b801d2cc git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ffd980f976e7fd666c2e61bf8ab35107efd11828 03dfe347c398fa41a7e30e8dc538f12568c183e6 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ffd980f976e7fd666c2e61bf8ab35107efd11828 18b45251e74e35668f0dd0c470549384ae191ecf git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ffd980f976e7fd666c2e61bf8ab35107efd11828 3ff8c24b421070a2db99a5cdb86edc9ff339418e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ffd980f976e7fd666c2e61bf8ab35107efd11828 eca8b44d51fc6ab61022258ec968e55e3073b79e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ffd980f976e7fd666c2e61bf8ab35107efd11828 b6317022b685a430a3ae420456716e3c0c02ef4b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ffd980f976e7fd666c2e61bf8ab35107efd11828 2f5976f54a04e9f18b25283036ac3136be453b17 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.25","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 2.6.25 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.265 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.216 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.183 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.148 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.101 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.42 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.5 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"72115","cve":"CVE-2026-72115","epss":"0.002810000","percentile":"0.206750000","score_date":"2026-08-19","updated_at":"2026-08-20 00:13:09"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/can/bcm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f147f48837cb1426521f5b3c3b3134c71128a25d","status":"affected","version":"ffd980f976e7fd666c2e61bf8ab35107efd11828","versionType":"git"},{"lessThan":"57cf104da4cf450ae9c16801a3164604b801d2cc","status":"affected","version":"ffd980f976e7fd666c2e61bf8ab35107efd11828","versionType":"git"},{"lessThan":"03dfe347c398fa41a7e30e8dc538f12568c183e6","status":"affected","version":"ffd980f976e7fd666c2e61bf8ab35107efd11828","versionType":"git"},{"lessThan":"18b45251e74e35668f0dd0c470549384ae191ecf","status":"affected","version":"ffd980f976e7fd666c2e61bf8ab35107efd11828","versionType":"git"},{"lessThan":"3ff8c24b421070a2db99a5cdb86edc9ff339418e","status":"affected","version":"ffd980f976e7fd666c2e61bf8ab35107efd11828","versionType":"git"},{"lessThan":"eca8b44d51fc6ab61022258ec968e55e3073b79e","status":"affected","version":"ffd980f976e7fd666c2e61bf8ab35107efd11828","versionType":"git"},{"lessThan":"b6317022b685a430a3ae420456716e3c0c02ef4b","status":"affected","version":"ffd980f976e7fd666c2e61bf8ab35107efd11828","versionType":"git"},{"lessThan":"2f5976f54a04e9f18b25283036ac3136be453b17","status":"affected","version":"ffd980f976e7fd666c2e61bf8ab35107efd11828","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/can/bcm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.25"},{"lessThan":"2.6.25","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.265","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.216","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.183","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.148","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.265","versionStartIncluding":"2.6.25","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.216","versionStartIncluding":"2.6.25","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.183","versionStartIncluding":"2.6.25","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.148","versionStartIncluding":"2.6.25","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.101","versionStartIncluding":"2.6.25","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.42","versionStartIncluding":"2.6.25","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.5","versionStartIncluding":"2.6.25","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"2.6.25","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: track a single source interface for ANYDEV timeout/throttle ops\n\nAn ANYDEV rx op (ifindex == 0) with an active RX timeout and/or\nthrottle timer has no defined semantics when matching frames arrive\nfrom several interfaces: bcm_rx_handler() can run concurrently for\nthe same op on different CPUs, racing hrtimer_cancel()/\nbcm_rx_starttimer() against bcm_rx_timeout_handler() and causing\nspurious RX_TIMEOUT notifications and last_frames corruption. The\nsame concurrency lets throttled multiplex frames from different\ninterfaces clobber the single rx_ifindex/rx_stamp fields shared by\nthe op.\n\nAdd op->if_detected to track the first interface that delivers a\nmatching frame while a timeout/throttle timer is configured, and\nreject frames from any other interface for that op. The claim is\ndecided in bcm_rx_handler() before hrtimer_cancel() touches\nop->timer, so a rejected frame can never disturb the claimed\ninterface's watchdog. RTR-mode ops are excluded via RX_RTR_FRAME,\nindependent of kt_ival1/kt_ival2, since those may briefly hold a\nstale value from an earlier non-RTR configuration.\n\nThe claim is released in bcm_notify() on NETDEV_UNREGISTER and in\nbcm_rx_setup() when SETTIMER reconfigures the timer values.\n\nA (re-)claim is only possible on CAN devices in NETREG_REGISTERED\ndev->reg_state to cover the release in bcm_notify() where reg_state\nbecomes NETREG_UNREGISTERING until synchronize_net()."}],"metrics":[{"cvssV3_1":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:A - bcm_rx_handler() is reached from the CAN driver RX path when matching frames arrive on multiple interfaces; on automotive/industrial systems an attacker on shared CAN segment(s) can inject concurrent frames without host shell access once an ANYDEV BCM RX op with active timeout/throttle timers exists.\nAC:L - The attacker controls both sides of the race by flooding matching frames on multiple CAN interfaces (or paired vcan devices) to run bcm_rx_handler() concurrently on different CPUs, racing hrtimer_cancel/bcm_rx_starttimer against bcm_rx_timeout_handler and interleaved last_frames writers.\nPR:N - No Linux capability or account is required to deliver triggering CAN traffic on multiple interfaces; bcm_rx_handler() runs from the unauthenticated netdev RX path once any ANYDEV BCM RX op with active kt_ival1/kt_ival2 timers exists, as commonly configured by telematics/diagnostic daemons.\nUI:N - Exploitation requires no victim interaction beyond normal system operation; malicious or concurrent CAN frames are processed automatically in softirq without mounts, file opens, or user prompts.\nS:U - Impact is confined to corrupted BCM state and incorrect CAN notifications delivered to the subscribing userspace process within the same kernel/host security boundary; no VM, container, or IOMMU escape is involved.\nC:H - Concurrent bcm_rx_handler() and bcm_rx_timeout_handler() races corrupt op->last_frames heap buffers via unsynchronized memcpy/memset, mixing attacker-controlled CAN payloads from different interfaces and leaking cross-bus frame content through bcm_send_to_user().\nI:H - last_frames corruption lets attacker-controlled frames from one interface overwrite or interleave with another's stored/throttled state, misattributing RX_CHANGED/RX_TIMEOUT notifications and corrupting safety- or security-relevant CAN monitoring and control decisions.\nA:N - The race corrupts per-op BCM buffers and emits spurious RX_TIMEOUT events but does not dereference freed objects, overrun buffer bounds, or fault the kernel; no oops, panic, hang, or sustained kernel denial of service is indicated."}]}],"providerMetadata":{"dateUpdated":"2026-08-19T16:36:03.316Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/f147f48837cb1426521f5b3c3b3134c71128a25d"},{"url":"https://git.kernel.org/stable/c/57cf104da4cf450ae9c16801a3164604b801d2cc"},{"url":"https://git.kernel.org/stable/c/03dfe347c398fa41a7e30e8dc538f12568c183e6"},{"url":"https://git.kernel.org/stable/c/18b45251e74e35668f0dd0c470549384ae191ecf"},{"url":"https://git.kernel.org/stable/c/3ff8c24b421070a2db99a5cdb86edc9ff339418e"},{"url":"https://git.kernel.org/stable/c/eca8b44d51fc6ab61022258ec968e55e3073b79e"},{"url":"https://git.kernel.org/stable/c/b6317022b685a430a3ae420456716e3c0c02ef4b"},{"url":"https://git.kernel.org/stable/c/2f5976f54a04e9f18b25283036ac3136be453b17"}],"title":"can: bcm: track a single source interface for ANYDEV timeout/throttle ops","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-72115","datePublished":"2026-08-15T05:52:55.524Z","dateReserved":"2026-08-09T03:40:39.906Z","dateUpdated":"2026-08-19T16:36:03.316Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-15 06:21:25","lastModifiedDate":"2026-08-17 06:18:10","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"72115","Ordinal":"1","Title":"can: bcm: track a single source interface for ANYDEV timeout/thr","CVE":"CVE-2026-72115","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"72115","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: track a single source interface for ANYDEV timeout/throttle ops\n\nAn ANYDEV rx op (ifindex == 0) with an active RX timeout and/or\nthrottle timer has no defined semantics when matching frames arrive\nfrom several interfaces: bcm_rx_handler() can run concurrently for\nthe same op on different CPUs, racing hrtimer_cancel()/\nbcm_rx_starttimer() against bcm_rx_timeout_handler() and causing\nspurious RX_TIMEOUT notifications and last_frames corruption. The\nsame concurrency lets throttled multiplex frames from different\ninterfaces clobber the single rx_ifindex/rx_stamp fields shared by\nthe op.\n\nAdd op->if_detected to track the first interface that delivers a\nmatching frame while a timeout/throttle timer is configured, and\nreject frames from any other interface for that op. The claim is\ndecided in bcm_rx_handler() before hrtimer_cancel() touches\nop->timer, so a rejected frame can never disturb the claimed\ninterface's watchdog. RTR-mode ops are excluded via RX_RTR_FRAME,\nindependent of kt_ival1/kt_ival2, since those may briefly hold a\nstale value from an earlier non-RTR configuration.\n\nThe claim is released in bcm_notify() on NETDEV_UNREGISTER and in\nbcm_rx_setup() when SETTIMER reconfigures the timer values.\n\nA (re-)claim is only possible on CAN devices in NETREG_REGISTERED\ndev->reg_state to cover the release in bcm_notify() where reg_state\nbecomes NETREG_UNREGISTERING until synchronize_net().","Type":"Description","Title":"can: bcm: track a single source interface for ANYDEV timeout/thr"}]}}}