CVE-2026-72115: In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for ANYDE
Summary
A vulnerability in the Linux kernel's CAN (controller area network, a protocol for vehicle communication) module allowed race conditions when multiple network interfaces sent matching frames to the same operation with timers enabled, causing corrupted data and false timeout alerts. The fix tracks which interface first delivers a frame to an operation and rejects frames from other interfaces, preventing the concurrent access problems.
Solution / Mitigation
Add op->if_detected to track the first interface delivering a matching frame while a timeout/throttle timer is configured, and reject frames from any other interface for that operation. The claim is released in bcm_notify() on NETDEV_UNREGISTER and in bcm_rx_setup() when SETTIMER reconfigures the timer values. A claim is only possible on CAN devices in NETREG_REGISTERED dev->reg_state.
Vulnerability Details
EPSS: 0.0%
August 15, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-72115
First tracked: August 15, 2026 at 08:08 AM
Classified by LLM (prompt v3) · confidence: 95%