CVE-2026-72117

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()

For an rx op subscribed on all interfaces (ifindex == 0), the same op

is registered once in the shared per-netns wildcard filter list, so

bcm_rx_handler() can run concurrently on different CPUs for frames

arriving on different net devices.

op->rx_stamp and op->rx_ifindex were written before bcm_rx_update_lock was

taken, allowing concurrent writers to race each other - including a torn

store of the 64-bit rx_stamp on 32-bit platforms.

Beyond a torn store bcm_send_to_user() must report the timestamp/ifindex

of the very same frame whose content it is delivering. So the assignment

is placed in the same unbroken bcm_rx_update_lock section as the content

comparison.

As a side effect, the RTR-request frame feature (which never reach

bcm_send_to_user()) no longer updates rx_stamp/rx_ifindex, since only

the notification path needs them.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References