CVE-2026-72123
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A use-after-free (UAF) vulnerability was found in the Linux kernel's CAN BCM (Broadcast Manager) module, specifically in the hrtimer. The issue stems from a missing RX_NO_AUTOTIMER flag check in the packet RX fast-path, allowing the timer to be re-armed after call_rcu() has scheduled memory deallocation. The fix defers timer cancellation and memory freeing to a dedicated workqueue and holds a socket reference until the deferred work completes.
Risk Assessment
The vulnerability could be exploited locally to cause a kernel panic (denial of service) or potentially lead to privilege escalation if an attacker can control the race. Organizations using CAN (e.g., embedded systems, automotive) are at risk of system instability.
Recommendation
Apply the official Linux kernel patch that resolves the issue by deferring deallocation to a workqueue. Update to a patched kernel version and monitor distribution security advisories.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF Commit f1b4e32aca08 ("can: bcm: use call_rcu() instead of costly synchronize_rcu()") replaced synchronize_rcu() in bcm_delete_rx_op() with call_rcu() and introduced the RX_NO_AUTOTIMER flag. However, this flag check was omitted for thrtimer in the packet rx fast-path. During BCM RX operation teardown, a concurrent RCU reader (bcm_rx_handler) can race and re-arm thrtimer via bcm_rx_update_and_send() after call_rcu() has been scheduled. Once the RCU grace period elapses, bcm_op is freed. The subsequently firing thrtimer then dereferences the deallocated op, causing a UAF. Adding flag checks to the rx fast-path (bcm_rx_update_and_send) does not fully close the TOCTOU race and introduces latency for every CAN frame. Conversely, calling hrtimer_cancel() directly inside the RCU callback (softirq context) is fatal as hrtimer_cancel() can sleep, triggering a "scheduling while atomic" panic. Resolve this by deferring the timer cancellation and memory free to a dedicated unbound workqueue (bcm_wq). The RCU callback now queues a work item to bcm_wq, which safely cancels both timers and deallocates memory in sleepable process context. A dedicated workqueue is used to prevent system-wide WQ saturation and is cleanly flushed/destroyed on module unload to avoid rmmod page faults. Since the deferred work can now outlive the calling context by an unbounded amount, also take a reference on op->sk when it is assigned and drop it only once the deferred work has cancelled both timers, so a socket can no longer be freed out from under a still-armed timer whose callback (bcm_send_to_user()) dereferences op->sk.