CVE-2026-72122 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, CAN subsystem users and administrators, security teams, and operators of systems using the Linux kernel's CAN subsystem should be aware of this vulnerability and take necessary actions to protect their systems. They should review and apply the patch, monitor CAN subsystem usage and logs for suspicious activity, and consider implementing additional security measures to prevent exploitation. This includes verifying the integrity of CAN interface configurations and ensuring that proper access controls are in place. Additionally, security teams should assess the potential impact on their systems and prioritize patching based on risk and exposure. Operators of critical infrastructure relying on CAN subsystems should take extra precautions to mitigate potential disruptions. Vulnerability management processes should be updated to account for this issue, and asset inventory should be reviewed to identify potentially affected systems. Collaboration with Linux kernel maintainers and CAN subsystem experts may be necessary for thorough mitigation and to stay informed about any further developments or advisories related to this vulnerability. Regular security audits and penetration testing should also be considered to identify and address any potential weaknesses in the CAN subsystem implementation. By taking these steps, organizations can enhance their security posture and reduce the risk associated with this vulnerability in the Linux kernel's CAN subsystem. Monitoring of CAN subsystem logs and network traffic can help detect potential exploitation attempts, allowing for swift response and mitigation. Implementing compensating controls, such as network segmentation or access restrictions, can also help minimize the impact of a potential exploit. Overall, a comprehensive approach to security, including timely patching, monitoring, and defensive measures, is essential to protect against this vulnerability in the Linux kernel's CAN subsystem. Security teams should also consider the potential for similar vulnerabilities in other subsystems and prioritize proactive security measures to prevent future issues. By prioritizing security and

Technical summary

The vulnerability was caused by a race condition in the bcm protocol, which could lead to a socket bound to a specific CAN interface being silently turned into one that matches 'any' interface. The fix involves moving the ifindex read and a bo->bound re-check into the locked section, ensuring that the two fields are not torn against each other. This change prevents the possibility of observing inconsistent combinations of bound and ifindex fields, thus resolving the issue. Linux kernel developers should review the patch and apply it to their systems to prevent potential security issues.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to the Linux kernel
• Monitor CAN subsystem usage and logs for suspicious activity
• Consider implementing additional security measures to prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was discovered in the Linux kernel's CAN subsystem, specifically in the bcm protocol. The issue was caused by a race condition between the bcm_sendmsg() function and other functions that mutate the bo->ifindex and bo->bound fields. The fix involves moving the ifindex read and a bo->bound re-check into the locked section, ensuring that the two fields are not torn against each other.

Official resources