CVE-2026-72121

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: add locking when updating filter and timer values

KCSAN detected a simultaneous access to timer values that can be

overwritten in bcm_rx_setup() when updating timer and filter content

while bcm_rx_handler(), bcm_rx_timeout_handler() or bcm_rx_thr_handler()

run concurrently on incoming CAN traffic.

Protect the timer (ival1/ival2/kt_ival1/kt_ival2/kt_lastmsg) and filter

(nframes/flags/frames/last_frames) updates in bcm_rx_setup() with a new

per-op bcm_rx_update_lock, taken with the matching scope in the RX

handlers. memcpy_from_msg() is staged into a temporary buffer before the

lock is taken, since it can sleep and must not run under a spinlock.

hrtimer_cancel() is always called without bcm_rx_update_lock held, since

bcm_rx_timeout_handler()/bcm_rx_thr_handler() take the same lock and a

running callback would otherwise deadlock against the canceller.

Also close a related race: bcm_rx_setup() cleared the RT

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References