Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-72126

can: isotp: use unconditional synchronize_rcu() in isotp_release()

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.261, 5.13, 5.14, 5.15.212, 6.1.178, and 4 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: can: isotp: use unconditional synchronize_rcu() in isotp_release() isotp_notify() unregisters the (RCU) CAN filters via can_rx_unregister() and clears so->bound without waiting for a grace period. isotp_release() uses so->bound to decide whether it needs to call synchronize_rcu() before cancelling so->rxtimer, so when NETDEV_UNREGISTER runs first it skips that synchronize_rcu() and can cancel the timer while an in-flight isotp_rcv() is still executing and about to re-arm it via isotp_send_fc(), leading to a use-after-free timer callback on the freed socket. sakisho-bot remarked a problem with rtnl_lock held in isotp_notify(), therefore make isotp_release() always call synchronize_rcu() before cancelling the timers, regardless of so->bound. This still closes the original race (isotp_notify() clearing so->bound without waiting for in-flight isotp_rcv() callers before isotp_release() cancels the RX timer) without adding any RCU wait to the netdevice notifier path.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From 22bfa94db2ef6900c790884fa9461486516626e9 · fixed in 945d9894502cd9124f5d676181c542ed2000f7c0; From 14a4696bc3118ba49da28f79280e1d55603aa737 · fixed in 59672aa4bcd8d32172c1ff6a179583981d6acabc; From 14a4696bc3118ba49da28f79280e1d55603aa737 · fixed in 15413a082df69175c2f96aeab4c26fe1ff7cff03; From 14a4696bc3118ba49da28f79280e1d55603aa737 · fixed in 6280eda96e0707264849fa7d036fed873c1f8a6d; From 14a4696bc3118ba49da28f79280e1d55603aa737 · fixed in cb6abc584a1bfab107ac003d64948a4aef1730aa; From 14a4696bc3118ba49da28f79280e1d55603aa737 · fixed in b88a511308779c225005d7994b8744561bdbafbc; From 14a4696bc3118ba49da28f79280e1d55603aa737 · fixed in b8278ff605187ef3fa0f2705e93251cce4c4f8ee; From 14a4696bc3118ba49da28f79280e1d55603aa737 · fixed in 9b1a02e0d980ac6b0e36a90378f847062f81d7e4; From 5.10.50 · fixed in 5.10.261; From 5.12.17 · fixed in 5.13; From 5.13.2 · fixed in 5.14

  • Linux Linux

    5.14

  • KernelLinux

    fixed in 5.10.261; From 5.11.0 · fixed in 5.15.212; From 5.14.0 · fixed in 6.1.178; From 5.16.0 · fixed in 6.6.145; From 6.2.0 · fixed in 6.12.97; From 6.7.0 · fixed in 6.18.40; From 6.13.0 · fixed in 7.1.5

References 8

git.kernel.org