Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-72113

can: bcm: add missing device refcount for CAN filter removal

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing device refcount for CAN filter removal sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is present in the bcm.c code. A former fix for raw.c commit c275a176e4b6 ("can: raw: add missing refcount for memory leak fix") introduced a netdevice_tracker which solves the issue for bcm.c too. bcm_release(), bcm_delete_rx_op() and bcm_notifier() relied on dev_get_by_index(ifindex) to re-find the device for an rx_op before unregistering its filter. If a concurrent NETDEV_UNREGISTER has already unlisted the device from the ifindex table, that lookup fails and can_rx_unregister() is silently skipped, leaving a stale CAN filter pointing at the soon-to-be-freed bcm_op/socket. Hold a netdev_hold()/netdev_put() tracked reference on op->rx_reg_dev from the moment the rx filter is registered in bcm_rx_setup() until it is unregistered in bcm_rx_unreg(), and use that reference directly in bcm_release() and bcm_delete_rx_op() instead of re-looking the device up by ifindex.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • ffd980f976e7fd666c2e61bf8ab35107efd11828 to < bd5232663524e94cc5aad861dca11e3db8e2ab6faffected
  • ffd980f976e7fd666c2e61bf8ab35107efd11828 to < ee8b36d0faca08f35b889b6e9aa850695e5b8ba9affected
  • ffd980f976e7fd666c2e61bf8ab35107efd11828 to < dcaee869913c7210cd47ed0a8f27349d7bdcdb7baffected
  • ffd980f976e7fd666c2e61bf8ab35107efd11828 to < 84aa4807816e405c1bf87114fc63e06d244281efaffected
  • ffd980f976e7fd666c2e61bf8ab35107efd11828 to < 633bda66fbf309f5de5e1ad6defe8e6b1d77a20faffected
  • ffd980f976e7fd666c2e61bf8ab35107efd11828 to < b024c21c9066f6957b7d4a8f2037e4b000c5e041affected
  • ffd980f976e7fd666c2e61bf8ab35107efd11828 to < 04d23061bbf18d5d81022eb21e9d32e99d24468daffected
  • ffd980f976e7fd666c2e61bf8ab35107efd11828 to < d59948293ea34b6337ce2b5febab8510de70048caffected

Linux Linux

Default version status: affected

  • 2.6.25affected
  • 0 to < 2.6.25unaffected
  • 5.10.265 to ≤ 5.10.*unaffected
  • 5.15.216 to ≤ 5.15.*unaffected
  • 6.1.183 to ≤ 6.1.*unaffected
  • 6.6.148 to ≤ 6.6.*unaffected
  • 6.12.101 to ≤ 6.12.*unaffected
  • 6.18.42 to ≤ 6.18.*unaffected
  • 7.1.5 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References