CVE-2026-72125

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER

isotp_release() looked up the bound network device via dev_get_by_index()

using the stored ifindex. During device unregistration the device is

unlisted from the ifindex hash before the NETDEV_UNREGISTER notifier

chain runs, so a concurrent isotp_release() could find no device, skip

can_rx_unregister() entirely, and still proceed to free the socket.

Since isotp_release() had already removed itself from the isotp

notifier list at that point, isotp_notify() would never get a chance to

clean up either, leaving a stale CAN filter that keeps pointing at the

freed socket.

Fix this the same way raw.c already does: hold a tracked reference to

the bound net_device in the socket (so->dev/so->dev_tracker) from

bind() onward instead of re-resolving it from the ifindex, and

serialize bind()/release() with rtnl_lock() so that so->dev is always

consistent with wh

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References