{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-72113 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-72113 is a high-severity vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-72113 and fix it if it is affected.\n\nWhat it is: CVE-2026-72113 is a high-severity vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-72113 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-72113/ (Markdown: https://insights.sbomify.com/CVE-2026-72113/index.md)","id":"CVE-2026-72113","markdown":"https://insights.sbomify.com/CVE-2026-72113/index.md","name":"CVE-2026-72113","record":{"aliases":["BELL-CVE-2026-72113","DEBIAN-CVE-2026-72113","GHSA-q526-m4v6-prwf","UBUNTU-CVE-2026-72113"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel CAN","requires_auth":"low_privilege","summary":"A race condition in the Linux kernel CAN BCM module can lead to a use-after-free or memory leak when a device is unregistered concurrently, causing a denial of service.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: add missing device refcount for CAN filter removal\n\nsashiko-bot remarked a problem with a concurrent device unregistration\nin isotp.c which also is present in the bcm.c code. A former fix for raw.c\ncommit c275a176e4b6 (\"can: raw: add missing refcount for memory leak fix\")\nintroduced a netdevice_tracker which solves the issue for bcm.c too.\n\nbcm_release(), bcm_delete_rx_op() and bcm_notifier() relied on\ndev_get_by_index(ifindex) to re-find the device for an rx_op before\nunregistering its filter. If a concurrent NETDEV_UNREGISTER has already\nunlisted the device from the ifindex table, that lookup fails and\ncan_rx_unregister() is silently skipped, leaving a stale CAN filter\npointing at the soon-to-be-freed bcm_op/socket.\n\nHold a netdev_hold()/netdev_put() tracked reference on op-\u003erx_reg_dev\nfrom the moment the rx filter is registered in bcm_rx_setup() until it\nis unregistered in bcm_rx_unreg(), and use that reference directly in\nbcm_release() and bcm_delete_rx_op() instead of re-looking the device\nup by ifindex.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"can: bcm: add missing device refcount for CAN filter removal","id":"CVE-2026-72113","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"race_condition","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"can: bcm: validate frame length in bcm_rx_setup() for RTR replies","id":"CVE-2026-72114"},"packages":[],"prev":{"headline":"io_uring/bpf-ops: reject re-registration of an already-bound ops","id":"CVE-2026-72112"},"products":["Linux"],"published":"2026-08-15","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-16","vendors":["Linux"]},"summary":"A race condition in the Linux kernel CAN BCM module can lead to a use-after-free or memory leak when a device is unregistered concurrently, causing a denial of service.","url":"https://insights.sbomify.com/CVE-2026-72113/"}