Linux CAN Subsystem Gets 14-CVE Race Condition Fix Wave

The August 15 Linux stable drop patched fourteen CVEs in the kernel’s CAN subsystem — twelve in can: bcm (CAN broadcast manager) and two in can: isotp (ISO 15765-2 transport protocol). The bugs are data races and use-after-free conditions that surfaced through KCSAN (the kernel concurrency sanitizer) and code review. None have confirmed exploitation in the wild. The affected drivers ship in any Linux build with CAN socket support, which includes vehicle infotainment systems, factory automation controllers, and embedded industrial hardware running kernels from 2020 onward.

The bcm cluster

can: bcm provides a higher-level CAN interface: programmable filters, TX cycling, rate throttling, and RX timeout handling. The twelve CVEs are concentrated in the intersection of the bcm socket lifecycle and CAN device unregistration — a notoriously difficult concurrency surface because device removal can race with any open socket operation.

CVE-2026-72123 — the most structurally notable in the batch — is a use-after-free in the throttle timer path. A 2024 commit replaced synchronize_rcu() with call_rcu() in bcm_delete_rx_op() to avoid blocking, but omitted the corresponding RX_NO_AUTOTIMER check in the fast-path packet receiver. A concurrent bcm_rx_handler() can re-arm the timer on an op already scheduled for deferred free, producing a timer UAF. The fix moves the rx_op deallocation to a workqueue so the timer cannot fire after teardown is committed. Source: git.kernel.org.

CVE-2026-72122 is a lockless race in bcm_sendmsg(), which reads bo->ifindex and checks bo->bound before acquiring lock_sock(). bcm_notify() (device unregister) and bcm_connect() (concurrent bind from another thread) both mutate both fields under the same lock. Because the lockless reads and locked writes are unordered, a racing notify or connect can produce a silent RX_SETUP failure — the call returns no error, but frame delivery is not re-enabled for the updated filter. Source: git.kernel.org.

CVE-2026-72121 (source), CVE-2026-72119 (source), CVE-2026-72117 (source), and CVE-2026-72118 (source) are all KCSAN-detected data races: timer values (ival1, ival2, kt_ival1, kt_ival2), filter configuration (nframes, flags, frames), and per-op statistics written concurrently from multiple CPUs without adequate locking. CVE-2026-72118 resolves the statistics race with atomic long operations in the hot packet-receive path.

The remaining six bcm CVEs address missing RCU list annotations on bcm_op insertion and removal (CVE-2026-72120), stale rx/tx ops after device removal (CVE-2026-72116), missing frame length validation for RTR reply frames (CVE-2026-72114), device refcount leaks on filter teardown (CVE-2026-72113), and ANYDEV per-source interface tracking for timeout/throttle timers (CVE-2026-72115).

The isotp pair

can: isotp implements ISO 15765-2 — the segmentation and reassembly protocol used over CAN for automotive diagnostics (OBD-II) and ECU programming. It carries actual data between diagnostic tools and vehicle subsystems; bugs here are in production vehicles and aftermarket diagnostic hardware, not just test setups.

CVE-2026-72125 is a use-after-free with a window that opens during network device removal. isotp_release() looked up the bound device via dev_get_by_index() using a stored ifindex. The kernel removes the device from the ifindex hash before firing NETDEV_UNREGISTER, so a racing isotp_release() can fail to find the device, skip can_rx_unregister(), and proceed to free the socket while an in-flight isotp timer or RCU reader still holds a reference. Source: git.kernel.org.

CVE-2026-72124 addresses the isotp TX state machine, which is driven by three concurrent contexts: sendmsg(), the RX path consuming Flow Control and echo frames, and two hrtimers handling stall timeouts. sendmsg() claimed the state with a lock-free cmpxchg(); hrtimer_cancel() calls elsewhere operated under so->rx_lock. The mismatch left windows where a timer callback or frame receipt could race with send cleanup. All TX state transitions are now serialized under so->rx_lock. Source: git.kernel.org.

Exposure and scope

can: bcm and can: isotp are compiled in by CONFIG_CAN_BCM and CONFIG_CAN_ISOTP respectively. The vector requires local CAN socket access — creating a socket with AF_CAN. That scopes the immediate threat to multi-user systems with CAN hardware, container environments where CAN interfaces are exposed, and any Linux endpoint with physical or network-adjacent CAN access, which is the standard operational profile for automotive ECU tooling and industrial CAN gateways.

The race conditions are not reliably reproducible under normal load; KCSAN detected several only under stress testing. The UAFs (CVE-2026-72123, CVE-2026-72125) are more straightforwardly dangerous — deferred-free paths with live timers are a known exploitation target class.

Update to the current Linux stable release. For embedded and automotive Linux images with fixed kernel versions — the common deployment model in ICS and vehicle ECU environments — identify which CVEs apply to your build configuration and prioritize CVE-2026-72123 and CVE-2026-72125 for any environment where CAN sockets are accessible from untrusted processes or external diagnostic ports.

Today’s August 15 stable drop also patched separate issues in the kernel’s WiFi drivers, SMB server, and device-mapper subsystem — see coverage of CVE-2026-72003 (brcmfmac WiFi heap overflow), CVE-2026-72044 (ksmbd stack overflow), and CVE-2026-72103 (dm LUKS key wipe).