Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-72117

can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() For an rx op subscribed on all interfaces (ifindex == 0), the same op is registered once in the shared per-netns wildcard filter list, so bcm_rx_handler() can run concurrently on different CPUs for frames arriving on different net devices. op->rx_stamp and op->rx_ifindex were written before bcm_rx_update_lock was taken, allowing concurrent writers to race each other - including a torn store of the 64-bit rx_stamp on 32-bit platforms. Beyond a torn store bcm_send_to_user() must report the timestamp/ifindex of the very same frame whose content it is delivering. So the assignment is placed in the same unbroken bcm_rx_update_lock section as the content comparison. As a side effect, the RTR-request frame feature (which never reach bcm_send_to_user()) no longer updates rx_stamp/rx_ifindex, since only the notification path needs them.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • ffd980f976e7fd666c2e61bf8ab35107efd11828 to < b64f60c468d149aca22ea56bb842b9730215aaa5affected
  • ffd980f976e7fd666c2e61bf8ab35107efd11828 to < c8a5d7cb095d3b12bd9dcf752d6ca0ff50872ac5affected
  • ffd980f976e7fd666c2e61bf8ab35107efd11828 to < 4b97410f4bba18d2ee2784c8e089104f387bc27caffected
  • ffd980f976e7fd666c2e61bf8ab35107efd11828 to < 5f246b96ab47523ec9b8ea870b5c567a3cb1eb1caffected
  • ffd980f976e7fd666c2e61bf8ab35107efd11828 to < 656ff69ef235699035e57d9e1ae417e62a38aa7faffected
  • ffd980f976e7fd666c2e61bf8ab35107efd11828 to < 136de17f38630307991c59aa7080012a99451783affected
  • ffd980f976e7fd666c2e61bf8ab35107efd11828 to < c312b750bb5ac3348cfc85dab25e90937bd4d251affected
  • ffd980f976e7fd666c2e61bf8ab35107efd11828 to < 58fd6cbc8541216af1d7ed272ea7ac2b66d50fd8affected

Linux Linux

Default version status: affected

  • 2.6.25affected
  • 0 to < 2.6.25unaffected
  • 5.10.265 to ≤ 5.10.*unaffected
  • 5.15.216 to ≤ 5.15.*unaffected
  • 6.1.183 to ≤ 6.1.*unaffected
  • 6.6.148 to ≤ 6.6.*unaffected
  • 6.12.101 to ≤ 6.12.*unaffected
  • 6.18.42 to ≤ 6.18.*unaffected
  • 7.1.5 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References