CVE-2026-72113

can: bcm: add missing device refcount for CAN filter removal

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: add missing device refcount for CAN filter removal

sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is present in the bcm.c code. A former fix for raw.c commit c275a176e4b6 ("can: raw: add missing refcount for memory leak fix") introduced a netdevice_tracker which solves the issue for bcm.c too.

bcm_release(), bcm_delete_rx_op() and bcm_notifier() relied on dev_get_by_index(ifindex) to re-find the device for an rx_op before unregistering its filter. If a concurrent NETDEV_UNREGISTER has already unlisted the device from the ifindex table, that lookup fails and can_rx_unregister() is silently skipped, leaving a stale CAN filter pointing at the soon-to-be-freed bcm_op/socket.

Hold a netdev_hold()/netdev_put() tracked reference on op->rx_reg_dev from the moment the rx filter is registered in bcm_rx_setup() until it is unregistered in bcm_rx_unreg(), and use that reference directly in bcm_release() and bcm_delete_rx_op() instead of re-looking the device up by ifindex.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ffd980f976e7fd666c2e61bf8ab35107efd11828 to before bd5232663524e94cc5aad861dca11e3db8e2ab6fAffected ffd980f976e7fd666c2e61bf8ab35107efd11828 to before ee8b36d0faca08f35b889b6e9aa850695e5b8ba9Affected ffd980f976e7fd666c2e61bf8ab35107efd11828 to before dcaee869913c7210cd47ed0a8f27349d7bdcdb7bAffected ffd980f976e7fd666c2e61bf8ab35107efd11828 to before 84aa4807816e405c1bf87114fc63e06d244281efAffected ffd980f976e7fd666c2e61bf8ab35107efd11828 to before 633bda66fbf309f5de5e1ad6defe8e6b1d77a20fAffected ffd980f976e7fd666c2e61bf8ab35107efd11828 to before b024c21c9066f6957b7d4a8f2037e4b000c5e041Affected ffd980f976e7fd666c2e61bf8ab35107efd11828 to before 04d23061bbf18d5d81022eb21e9d32e99d24468dAffected ffd980f976e7fd666c2e61bf8ab35107efd11828 to before d59948293ea34b6337ce2b5febab8510de70048cAffected
LinuxLinux	2.6.25Affected before 2.6.25Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

ffd980f976e7fd666c2e61bf8ab35107efd11828 to before bd5232663524e94cc5aad861dca11e3db8e2ab6fAffected
ffd980f976e7fd666c2e61bf8ab35107efd11828 to before ee8b36d0faca08f35b889b6e9aa850695e5b8ba9Affected
ffd980f976e7fd666c2e61bf8ab35107efd11828 to before dcaee869913c7210cd47ed0a8f27349d7bdcdb7bAffected
ffd980f976e7fd666c2e61bf8ab35107efd11828 to before 84aa4807816e405c1bf87114fc63e06d244281efAffected
ffd980f976e7fd666c2e61bf8ab35107efd11828 to before 633bda66fbf309f5de5e1ad6defe8e6b1d77a20fAffected
ffd980f976e7fd666c2e61bf8ab35107efd11828 to before b024c21c9066f6957b7d4a8f2037e4b000c5e041Affected
ffd980f976e7fd666c2e61bf8ab35107efd11828 to before 04d23061bbf18d5d81022eb21e9d32e99d24468dAffected
ffd980f976e7fd666c2e61bf8ab35107efd11828 to before d59948293ea34b6337ce2b5febab8510de70048cAffected

LinuxLinux

2.6.25Affected
before 2.6.25Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.