CVE-2026-72113 Linux CVE debrief

Who should care

Linux kernel users and administrators, particularly those responsible for maintaining and securing Linux-based systems, should be aware of this vulnerability and take necessary precautions. This includes verifying and applying available updates, monitoring CAN filter removal and device unregistration, and implementing compensating controls for CAN filter management. Additionally, operators and platform administrators should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Vulnerability management and security teams should prioritize patching and mitigating this vulnerability to prevent potential exploitation. Those responsible for asset inventory and change management should also be aware of the potential impact on their systems and plan accordingly. This may involve reviewing compensating controls for exposed systems while remediation is scheduled and verified, checking relevant monitoring, detection, and logs for exposed assets that need extra review, and tracking exceptions and retesting remediated assets. The goal is to ensure that all necessary measures are taken to prevent potential exploitation and minimize the risk associated with this vulnerability. This requires a coordinated effort from various stakeholders, including operators, administrators, and security teams, to ensure the timely and effective mitigation of this vulnerability. By taking proactive steps to address this issue, organizations can reduce the risk of exploitation and protect their Linux-based systems from potential attacks. Furthermore, it is essential to review and update incident response plans to account for this vulnerability and ensure that all necessary procedures are in place to respond to potential security incidents. This includes identifying and prioritizing affected systems, developing and implementing patches or workarounds, and conducting thorough testing and validation to ensure the effectiveness of the mitigation measures. By prioritizing the mitigation of this vulnerability and taking proactive steps to protect their systems, organizations can minimize the risk associated with this issue and ensure the secure

Technical summary

The Linux kernel vulnerability involves a missing device refcount for CAN filter removal in the bcm.c code. A former fix for raw.c introduced a netdevice_tracker which solves the issue for bcm.c too. The vulnerability relies on dev_get_by_index(ifindex) to re-find the device for an rx_op before unregistering its filter. If a concurrent NETDEV_UNREGISTER has already unlisted the device from the ifindex table, that lookup fails and can_rx_unregister() is silently skipped, leaving a stale CAN filter pointing at the soon-to-be-freed bcm_op/socket.

Defensive priority

Linux kernel users should verify and apply available updates to mitigate potential CAN filter removal issues.

Recommended defensive actions

• Verify and apply available Linux kernel updates
• Monitor CAN filter removal and device unregistration
• Implement compensating controls for CAN filter management
• Review CAN filter configurations and update them as necessary
• Implement additional logging and monitoring for CAN filter removal events
• Verify CAN filter removal and device unregistration procedures
• Track exceptions and retest remediated assets

Evidence notes

The Linux kernel vulnerability involves a missing device refcount for CAN filter removal in the bcm.c code. A former fix for raw.c introduced a netdevice_tracker which solves the issue for bcm.c too. The vulnerability relies on dev_get_by_index(ifindex) to re-find the device for an rx_op before unregistering its filter. If a concurrent NETDEV_UNREGISTER has already unlisted the device from the ifindex table, that lookup fails and can_rx_unregister() is silently skipped, leaving a stale CAN filter pointing at the soon-to-be-freed bcm_op/socket.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.