CVE-2026-72118 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of Linux kernel who use CAN frame rx/tx statistics should be aware of this vulnerability and take necessary actions to prevent potential data races. This includes reviewing and applying the provided patch, updating Linux kernel to the latest version with the patch, and monitoring Linux kernel updates for potential related vulnerabilities. Affected operators, platforms, and security teams should prioritize reviewing and applying the provided patch to prevent potential data races in CAN frame rx/tx statistics.

Technical summary

The Linux kernel vulnerability CVE-2026-72118 is caused by a data race within the bcm_rx_handler() when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs. The issue was resolved by using atomic operations with (signed) long data types to access the statistics in the hot path. Additionally, simplify the update and check of statistics overflow by using the atomic operations in separate bcm_update_[rx|tx]_stats() functions. The rx variant runs under bcm_rx_update_lock to prevent races when resetting the two rx counters; the tx variant runs under bcm_tx_lock and only needs to guard its own counter's overflow.

Defensive priority

Linux kernel maintainers and users should prioritize reviewing and applying the provided patch to prevent potential data races in CAN frame rx/tx statistics.

Recommended defensive actions

• Review and apply the provided patch to prevent potential data races in CAN frame rx/tx statistics.
• Update Linux kernel to the latest version with the patch.
• Monitor Linux kernel updates for potential related vulnerabilities.
• Perform a thorough review of the Linux kernel's CAN frame rx/tx statistics to identify potential data races.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The KCSAN detected a data race within the bcm_rx_handler() when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs. The issue was resolved by using atomic operations with (signed) long data types to access the statistics in the hot path. Further analysis and verification are required to confirm the affected scope and severity of this vulnerability. Linux kernel maintainers, Linux distribution maintainers, and users of Linux kernel who use CAN frame rx/tx statistics should review the provided patch and take necessary actions to prevent potential data races.

Official resources