CVE-2026-72116

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: fix stale rx/tx ops after device removal

RX: an RX_SETUP update(!) for an existing op skipped can_rx_register()

unconditionally, even when a concurrent NETDEV_UNREGISTER had already

torn down its registration (op->rx_reg_dev == NULL). This silently

did not re-enable frame delivery for that updated filter. bcm_rx_setup()

now re-registers in that case, while leaving rx_ops with ifindex = 0

(all CAN devices) which never carry a tracked rx_reg_dev registered as-is.

TX: bcm_notify() only handled bo->rx_ops on NETDEV_UNREGISTER, leaving

tx_ops with an active cyclic transmission re-arming its hrtimer

indefinitely to execute bcm_tx_timeout_handler(). Cancelling the hrtimer

prevents the runaway timer and any injection into a later reused ifindex,

since nothing else calls bcm_can_tx() for the op until an explicit

TX_SETUP update re-arms it.

Unlike bcm_rx_unreg(), which clears the tracked rx_reg_dev for rx_ops,

the

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References