{"id":"CVE-2026-72113","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-72113","summary":"can: bcm: add missing device refcount for CAN filter removal","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: add missing device refcount for CAN filter removal\n\nsashiko-bot remarked a problem with a concurrent device unregistration\nin isotp.c which also is present in the bcm.c code. A former fix for raw.c\ncommit c275a176e4b6 (\"can: raw: add missing refcount for memory leak fix\")\nintroduced a netdevice_tracker which solves the issue for bcm.c too.\n\nbcm_release(), bcm_delete_rx_op() and bcm_notifier() relied on\ndev_get_by_index(ifindex) to re-find the device for an rx_op before\nunregistering its filter. If a concurrent NETDEV_UNREGISTER has already\nunlisted the device from the ifindex table, that lookup fails and\ncan_rx_unregister() is silently skipped, leaving a stale CAN filter\npointing at the soon-to-be-freed bcm_op/socket.\n\nHold a netdev_hold()/netdev_put() tracked reference on op->rx_reg_dev\nfrom the moment the rx filter is registered in bcm_rx_setup() until it\nis unregistered in bcm_rx_unreg(), and use that reference directly in\nbcm_release() and bcm_delete_rx_op() instead of re-looking the device\nup by ifindex.","published":"2026-08-15T05:52:54.001Z","modified":"2026-08-18T03:56:20.312728919Z","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"6.6.148"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/04d23061bbf18d5d81022eb21e9d32e99d24468d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/633bda66fbf309f5de5e1ad6defe8e6b1d77a20f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/84aa4807816e405c1bf87114fc63e06d244281ef"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b024c21c9066f6957b7d4a8f2037e4b000c5e041"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d59948293ea34b6337ce2b5febab8510de70048c"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72113.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72113"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-18T03:56:20.312728919Z"}}