CVE-2026-72113: can: bcm: add missing device refcount for CAN filter removal
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: add missing device refcount for CAN filter removal
sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is present in the bcm.c code. A former fix for raw.c commit c275a176e4b6 ("can: raw: add missing refcount for memory leak fix") introduced a netdevicetracker which solves the issue for bcm.c too.
bcmrelease(), bcmdeleterxop() and bcmnotifier() relied on devgetbyindex(ifindex) to re-find the device for an rxop before unregistering its filter. If a concurrent NETDEVUNREGISTER has already unlisted the device from the ifindex table, that lookup fails and canrxunregister() is silently skipped, leaving a stale CAN filter pointing at the soon-to-be-freed bcmop/socket.
Hold a netdevhold()/netdevput() tracked reference on op->rxregdev from the moment the rx filter is registered in bcmrxsetup() until it is unregistered in bcmrxunreg(), and use that reference directly in bcmrelease() and bcmdeleterxop() instead of re-looking the device up by ifindex.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72113?
The CVE-2026-72113 vulnerability has a risk score of 38.
What systems are affected by CVE-2026-72113?
CVE-2026-72113 affects the Linux kernel's CAN protocol components.
How do I fix CVE-2026-72113?
To address CVE-2026-72113, update your Linux kernel to the patched version that includes the fix.
Is CVE-2026-72113 a denial of service vulnerability?
CVE-2026-72113 pertains to device reference counting issues, which could lead to instability during CAN filter removal.
What are the implications of CVE-2026-72113 for system stability?
CVE-2026-72113 can cause issues with concurrent device unregistration, potentially affecting overall system reliability.