CVE-2026-72118: can: bcm: fix CAN frame rx/tx statistics

Published Aug 15, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: fix CAN frame rx/tx statistics

KCSAN detected a data race within the bcmrxhandler() when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs.

Use atomic operations with (signed) long data types to access the statistics in the hot path to fix the KCSAN complaint.

Additionally simplify the update and check of statistics overflow by using the atomic operations in separate bcmupdate[rx|tx]stats() functions. The rx variant runs under bcmrxupdatelock to prevent races when resetting the two rx counters; the tx variant runs under bcmtxlock and only needs to guard its own counter's overflow.

As the rx path resets its values already at LONGMAX / 100, there is no conflict between the two locking domains (bcmrxupdatelock vs. bcmtxlock) even for ops that use both paths.

The rx statistics update and the framesfiltered update in bcmrxchanged() were previously performed in two separate bcmrxupdatelock sections. For an rx op subscribed on all interfaces (ifindex == 0), bcmrxhandler() can run concurrently on different CPUs, so a counter reset by one CPU between these two sections could leave framesfiltered larger than framesabs on another CPU, producing a bogus (even negative) reduction percentage in procfs. Update the statistics in the same critical section as bcmrxchanged() to close this gap, which also removes the now unneeded extra lock/unlock pair around the trafficflags calculation.

Affected Software

1 affected component
Linux Linux kernel

Event History

Aug 15, 2026
CVE Published
via MITRE·05:52 AM
Data Sourced
via MITRE·05:52 AM
Description
Data Sourced
via NVD·06:21 AM
Description
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-72118?

The severity of CVE-2026-72118 is rated as 4.

2

How do I fix CVE-2026-72118?

To fix CVE-2026-72118, ensure that your Linux kernel version includes the patch that resolves the data race in bcm_rx_handler.

3

What systems are affected by CVE-2026-72118?

CVE-2026-72118 affects systems using the Linux kernel with the bcm CAN frame handling functionality.

4

What causes CVE-2026-72118?

CVE-2026-72118 is caused by a data race occurring when two CAN frames are processed simultaneously by different CPUs.

5

Is CVE-2026-72118 an exploitable vulnerability?

CVE-2026-72118 represents a risk due to concurrent access issues, which can potentially lead to unreliable CAN frame processing.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203