CVE-2026-72126

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

can: isotp: use unconditional synchronize_rcu() in isotp_release()

isotp_notify() unregisters the (RCU) CAN filters via can_rx_unregister()

and clears so->bound without waiting for a grace period. isotp_release()

uses so->bound to decide whether it needs to call synchronize_rcu()

before cancelling so->rxtimer, so when NETDEV_UNREGISTER runs first it

skips that synchronize_rcu() and can cancel the timer while an

in-flight isotp_rcv() is still executing and about to re-arm it via

isotp_send_fc(), leading to a use-after-free timer callback on the

freed socket.

sakisho-bot remarked a problem with rtnl_lock held in isotp_notify(),

therefore make isotp_release() always call synchronize_rcu() before

cancelling the timers, regardless of so->bound. This still closes the

original race (isotp_notify() clearing so->bound without waiting for

in-flight isotp_rcv() callers before isotp_release() cancels the RX

timer) without addin

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References