{"id":"CVE-2026-72126","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-72126","summary":"can: isotp: use unconditional synchronize_rcu() in isotp_release()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: isotp: use unconditional synchronize_rcu() in isotp_release()\n\nisotp_notify() unregisters the (RCU) CAN filters via can_rx_unregister()\nand clears so->bound without waiting for a grace period. isotp_release()\nuses so->bound to decide whether it needs to call synchronize_rcu()\nbefore cancelling so->rxtimer, so when NETDEV_UNREGISTER runs first it\nskips that synchronize_rcu() and can cancel the timer while an\nin-flight isotp_rcv() is still executing and about to re-arm it via\nisotp_send_fc(), leading to a use-after-free timer callback on the\nfreed socket.\n\nsakisho-bot remarked a problem with rtnl_lock held in isotp_notify(),\ntherefore make isotp_release() always call synchronize_rcu() before\ncancelling the timers, regardless of so->bound. This still closes the\noriginal race (isotp_notify() clearing so->bound without waiting for\nin-flight isotp_rcv() callers before isotp_release() cancels the RX\ntimer) without adding any RCU wait to the netdevice notifier path.","published":"2026-08-15T05:53:03.642Z","modified":"2026-08-16T03:48:32.352983319Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"5.10.261"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/15413a082df69175c2f96aeab4c26fe1ff7cff03"},{"type":"WEB","url":"https://git.kernel.org/stable/c/59672aa4bcd8d32172c1ff6a179583981d6acabc"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6280eda96e0707264849fa7d036fed873c1f8a6d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/945d9894502cd9124f5d676181c542ed2000f7c0"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9b1a02e0d980ac6b0e36a90378f847062f81d7e4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b8278ff605187ef3fa0f2705e93251cce4c4f8ee"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b88a511308779c225005d7994b8744561bdbafbc"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cb6abc584a1bfab107ac003d64948a4aef1730aa"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72126.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72126"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-16T03:48:32.352983319Z"}}