CVE-2026-72117 can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
A data race in the Linux kernel CAN BCM handler allows concurrent writes to timestamp fields, potentially causing torn reads or inconsistent state for local attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72117?
CVE-2026-72117 is a vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
For an rx op subscribed on all interfaces (ifindex == 0), the same op is registered once in the shared per-netns wildcard filter list, so bcm_rx_handler() can run concurrently on different CPUs for frames arriving on different net devices.
op->rx_stamp and op->rx_ifindex were written before bcm_rx_update_lock was taken, allowing concurrent writers to race each other - including a torn store of the 64-bit rx_stamp on 32-bit platforms.
Beyond a torn store bcm_send_to_user() must report the timestamp/ifindex of the very same frame whose content it is delivering. So the assignment is placed in the same unbroken bcm_rx_update_lock section as the content comparison.
As a side effect, the RTR-request frame feature (which never reach bcm_send_to_user()) no longer updates rx_stamp/rx_ifindex, since only the notification path needs them.
Which versions are affected by CVE-2026-72117?
How do I fix CVE-2026-72117?
Apply the vendor's patch.
Is CVE-2026-72117 being exploited?
There is no known exploitation of CVE-2026-72117 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72117, DEBIAN-CVE-2026-72117, GHSA-rcrc-h682-pmgg, UBUNTU-CVE-2026-72117.