CVE-2026-72115

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: track a single source interface for ANYDEV timeout/throttle ops

An ANYDEV rx op (ifindex == 0) with an active RX timeout and/or

throttle timer has no defined semantics when matching frames arrive

from several interfaces: bcm_rx_handler() can run concurrently for

the same op on different CPUs, racing hrtimer_cancel()/

bcm_rx_starttimer() against bcm_rx_timeout_handler() and causing

spurious RX_TIMEOUT notifications and last_frames corruption. The

same concurrency lets throttled multiplex frames from different

interfaces clobber the single rx_ifindex/rx_stamp fields shared by

the op.

Add op->if_detected to track the first interface that delivers a

matching frame while a timeout/throttle timer is configured, and

reject frames from any other interface for that op. The claim is

decided in bcm_rx_handler() before hrtimer_cancel() touches

op->timer, so a rejected frame can never disturb the claimed

interface's wa

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References