CVE-2026-72123

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF

Commit f1b4e32aca08 ("can: bcm: use call_rcu() instead of costly

synchronize_rcu()") replaced synchronize_rcu() in bcm_delete_rx_op()

with call_rcu() and introduced the RX_NO_AUTOTIMER flag.

However, this flag check was omitted for thrtimer in the packet rx

fast-path. During BCM RX operation teardown, a concurrent RCU reader

(bcm_rx_handler) can race and re-arm thrtimer via

bcm_rx_update_and_send() after call_rcu() has been scheduled. Once

the RCU grace period elapses, bcm_op is freed. The subsequently

firing thrtimer then dereferences the deallocated op, causing a UAF.

Adding flag checks to the rx fast-path (bcm_rx_update_and_send) does not

fully close the TOCTOU race and introduces latency for every CAN frame.

Conversely, calling hrtimer_cancel() directly inside the RCU callback

(softirq context) is fatal as hrtimer_cancel() can sleep, triggeri

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References