CVE-2026-72120: can: bcm: add missing rcu list annotations and operations
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: add missing rcu list annotations and operations
sashiko-bot remarked the missing use of listaddrcu() in bcm[rx|tx]setup() to have a proper initialized bcmop structure when bcmprocshow() traverses the bcmop's under rcureadlock().
To cover all initial settings of the bcmop's the listaddrcu() calls are moved to the end of the setup code.
While at it, also fix the mirroring removal side: bcmrelease() called bcmremoveop() - which frees the op via callrcu() - on ops that were still linked in bo->txops/bo->rxops, without listdelrcu() first. Unlink each op with listdelrcu() before handing it to bcmremoveop(), matching the existing pattern in bcmdeletetxop()/bcmdeleterxop().
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72120?
CVE-2026-72120 has a risk severity score of 27.
How do I fix CVE-2026-72120?
To fix CVE-2026-72120, you should update your Linux kernel to the latest version that contains the patch addressing the vulnerability.
What systems are affected by CVE-2026-72120?
CVE-2026-72120 affects the Linux kernel, particularly versions prior to the fix that was published on August 15, 2026.
What is the nature of the vulnerability in CVE-2026-72120?
CVE-2026-72120 involves missing rcu list annotations and operations in the CAN BCM implementation of the Linux kernel.
Who reported CVE-2026-72120?
CVE-2026-72120 was remarked by sashiko-bot, highlighting the importance of proper initialization in the bcm_op structure.