{"id":"CVE-2026-72126","state":"PUBLISHED","title":"can: isotp: use unconditional synchronize_rcu() in isotp_release()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: isotp: use unconditional synchronize_rcu() in isotp_release()\n\nisotp_notify() unregisters the (RCU) CAN filters via can_rx_unregister()\nand clears so->bound without waiting for a grace period. isotp_release()\nuses so->bound to decide whether it needs to call synchronize_rcu()\nbefore cancelling so->rxtimer, so when NETDEV_UNREGISTER runs first it\nskips that synchronize_rcu() and can cancel the timer while an\nin-flight isotp_rcv() is still executing and about to re-arm it via\nisotp_send_fc(), leading to a use-after-free timer callback on the\nfreed socket.\n\nsakisho-bot remarked a problem with rtnl_lock held in isotp_notify(),\ntherefore make isotp_release() always call synchronize_rcu() before\ncancelling the timers, regardless of so->bound. This still closes the\noriginal race (isotp_notify() clearing so->bound without waiting for\nin-flight isotp_rcv() callers before isotp_release() cancels the RX\ntimer) without adding any RCU wait to the netdevice notifier path.","publishedAt":"2026-08-15T05:53:03.642Z","updatedAt":"2026-10-16T18:44:58.135Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"22bfa94db2ef6900c790884fa9461486516626e9","status":"affected","lessThan":"945d9894502cd9124f5d676181c542ed2000f7c0","versionType":"git"},{"version":"14a4696bc3118ba49da28f79280e1d55603aa737","status":"affected","lessThan":"59672aa4bcd8d32172c1ff6a179583981d6acabc","versionType":"git"},{"version":"14a4696bc3118ba49da28f79280e1d55603aa737","status":"affected","lessThan":"15413a082df69175c2f96aeab4c26fe1ff7cff03","versionType":"git"},{"version":"14a4696bc3118ba49da28f79280e1d55603aa737","status":"affected","lessThan":"6280eda96e0707264849fa7d036fed873c1f8a6d","versionType":"git"},{"version":"14a4696bc3118ba49da28f79280e1d55603aa737","status":"affected","lessThan":"cb6abc584a1bfab107ac003d64948a4aef1730aa","versionType":"git"},{"version":"14a4696bc3118ba49da28f79280e1d55603aa737","status":"affected","lessThan":"b88a511308779c225005d7994b8744561bdbafbc","versionType":"git"},{"version":"14a4696bc3118ba49da28f79280e1d55603aa737","status":"affected","lessThan":"b8278ff605187ef3fa0f2705e93251cce4c4f8ee","versionType":"git"},{"version":"14a4696bc3118ba49da28f79280e1d55603aa737","status":"affected","lessThan":"9b1a02e0d980ac6b0e36a90378f847062f81d7e4","versionType":"git"},{"version":"80c6ddf771df2ef786f28c1ca5919b3f1080091b","status":"affected","versionType":"git"},{"version":"ebf91625b3e404bd2b4b694c7ee71c1e8f8bd08f","status":"affected","versionType":"git"},{"version":"5.10.50","status":"affected","lessThan":"5.10.261","versionType":"semver"},{"version":"5.12.17","status":"affected","lessThan":"5.13","versionType":"semver"},{"version":"5.13.2","status":"affected","lessThan":"5.14","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/can/isotp.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.14","versionType":"semver"},{"version":"5.10.261","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.212","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/can/isotp.c"]}],"references":["https://git.kernel.org/stable/c/945d9894502cd9124f5d676181c542ed2000f7c0","https://git.kernel.org/stable/c/59672aa4bcd8d32172c1ff6a179583981d6acabc","https://git.kernel.org/stable/c/15413a082df69175c2f96aeab4c26fe1ff7cff03","https://git.kernel.org/stable/c/6280eda96e0707264849fa7d036fed873c1f8a6d","https://git.kernel.org/stable/c/cb6abc584a1bfab107ac003d64948a4aef1730aa","https://git.kernel.org/stable/c/b88a511308779c225005d7994b8744561bdbafbc","https://git.kernel.org/stable/c/b8278ff605187ef3fa0f2705e93251cce4c4f8ee","https://git.kernel.org/stable/c/9b1a02e0d980ac6b0e36a90378f847062f81d7e4"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/72xxx/CVE-2026-72126.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72126","state":"PUBLISHED","datePublished":"2026-08-15T05:53:03.642Z","dateUpdated":"2026-10-16T18:44:58.135Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-09T03:40:39.907Z"},"containers":{"cna":{"title":"can: isotp: use unconditional synchronize_rcu() in isotp_release()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: isotp: use unconditional synchronize_rcu() in isotp_release()\n\nisotp_notify() unregisters the (RCU) CAN filters via can_rx_unregister()\nand clears so->bound without waiting for a grace period. isotp_release()\nuses so->bound to decide whether it needs to call synchronize_rcu()\nbefore cancelling so->rxtimer, so when NETDEV_UNREGISTER runs first it\nskips that synchronize_rcu() and can cancel the timer while an\nin-flight isotp_rcv() is still executing and about to re-arm it via\nisotp_send_fc(), leading to a use-after-free timer callback on the\nfreed socket.\n\nsakisho-bot remarked a problem with rtnl_lock held in isotp_notify(),\ntherefore make isotp_release() always call synchronize_rcu() before\ncancelling the timers, regardless of so->bound. This still closes the\noriginal race (isotp_notify() clearing so->bound without waiting for\nin-flight isotp_rcv() callers before isotp_release() cancels the RX\ntimer) without adding any RCU wait to the netdevice notifier path."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"22bfa94db2ef6900c790884fa9461486516626e9","status":"affected","lessThan":"945d9894502cd9124f5d676181c542ed2000f7c0","versionType":"git"},{"version":"14a4696bc3118ba49da28f79280e1d55603aa737","status":"affected","lessThan":"59672aa4bcd8d32172c1ff6a179583981d6acabc","versionType":"git"},{"version":"14a4696bc3118ba49da28f79280e1d55603aa737","status":"affected","lessThan":"15413a082df69175c2f96aeab4c26fe1ff7cff03","versionType":"git"},{"version":"14a4696bc3118ba49da28f79280e1d55603aa737","status":"affected","lessThan":"6280eda96e0707264849fa7d036fed873c1f8a6d","versionType":"git"},{"version":"14a4696bc3118ba49da28f79280e1d55603aa737","status":"affected","lessThan":"cb6abc584a1bfab107ac003d64948a4aef1730aa","versionType":"git"},{"version":"14a4696bc3118ba49da28f79280e1d55603aa737","status":"affected","lessThan":"b88a511308779c225005d7994b8744561bdbafbc","versionType":"git"},{"version":"14a4696bc3118ba49da28f79280e1d55603aa737","status":"affected","lessThan":"b8278ff605187ef3fa0f2705e93251cce4c4f8ee","versionType":"git"},{"version":"14a4696bc3118ba49da28f79280e1d55603aa737","status":"affected","lessThan":"9b1a02e0d980ac6b0e36a90378f847062f81d7e4","versionType":"git"},{"version":"80c6ddf771df2ef786f28c1ca5919b3f1080091b","status":"affected","versionType":"git"},{"version":"ebf91625b3e404bd2b4b694c7ee71c1e8f8bd08f","status":"affected","versionType":"git"},{"version":"5.10.50","status":"affected","lessThan":"5.10.261","versionType":"semver"},{"version":"5.12.17","status":"affected","lessThan":"5.13","versionType":"semver"},{"version":"5.13.2","status":"affected","lessThan":"5.14","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/can/isotp.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.14","versionType":"semver"},{"version":"5.10.261","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.212","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/can/isotp.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/945d9894502cd9124f5d676181c542ed2000f7c0"},{"url":"https://git.kernel.org/stable/c/59672aa4bcd8d32172c1ff6a179583981d6acabc"},{"url":"https://git.kernel.org/stable/c/15413a082df69175c2f96aeab4c26fe1ff7cff03"},{"url":"https://git.kernel.org/stable/c/6280eda96e0707264849fa7d036fed873c1f8a6d"},{"url":"https://git.kernel.org/stable/c/cb6abc584a1bfab107ac003d64948a4aef1730aa"},{"url":"https://git.kernel.org/stable/c/b88a511308779c225005d7994b8744561bdbafbc"},{"url":"https://git.kernel.org/stable/c/b8278ff605187ef3fa0f2705e93251cce4c4f8ee"},{"url":"https://git.kernel.org/stable/c/9b1a02e0d980ac6b0e36a90378f847062f81d7e4"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The UAF is reached through local AF_CAN CAN_ISOTP socket syscalls (socket/bind/close) racing in-kernel ISO-TP RX; a CAN peer can deliver frames, but exploitation requires a local process to close the socket while NETDEV_UNREGISTER clears so->bound.\nAC:L - The attacker controls all race sides: ISO-TP RX traffic via a local CAN socket or bus peer, concurrent close() on the ISOTP socket, and NETDEV_UNREGISTER by deleting the bound vcan/CAN interface (e.g., in a user namespace with CAP_NET_ADMIN).\nPR:L - CAN_ISOTP socket create/bind/sendmsg/close paths impose no CAP_NET_ADMIN check; an unprivileged local user with access to a CAN netdev, including a user-namespace vcan they create, can reach the vulnerable release/timer path.\nUI:N - No victim interaction is required once the attacker can execute local code; they can open the ISO-TP socket, drive RX via CAN frames, delete the netdev, and close the socket to race isotp_rcv() against isotp_release().\nS:U - Exploitation corrupts kernel heap memory within the same OS security boundary (standard kernel UAF), not a VM/host or IOMMU sandbox escape.\nC:H - Use-after-free of struct isotp_sock in isotp_rx_timer_handler reads freed memory (so->rx.state, sock fields), enabling heap grooming for arbitrary kernel memory disclosure per conservative UAF scoring guidance.\nI:H - The timer callback performs writes to fields within the freed isotp_sock/socket object, giving attacker-influenced kernel heap corruption that can be developed into arbitrary write or privilege-escalation primitives.\nA:H - Executing isotp_rx_timer_handler on a freed socket can cause kernel oops/panic or fatal memory corruption; the UAF is reliably triggerable with attacker-controlled timing."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T05:40:40.020Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.50","versionEndExcluding":"5.10.261"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"5.15.212"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.1.178"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"7.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12.17"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-72126","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T18:42:20.650624Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T18:44:58.135Z"}}]}}}