CVE-2026-72125 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, CAN isotp users and implementers, operators of Linux-based systems, security teams responsible for vulnerability management, and platform administrators who manage Linux systems.

Technical summary

The Linux kernel's CAN isotp implementation has a use-after-free race condition vulnerability. The vulnerability occurs when a concurrent NETDEV_UNREGISTER event is processed while isotp_release() is executing, leading to a potential use-after-free error. The vulnerability was resolved by holding a tracked reference to the bound net_device in the socket and serializing bind()/release() with rtnl_lock().

Defensive priority

High

Recommended defensive actions

• Apply the patch to the Linux kernel to fix the vulnerability
• Review and update CAN isotp implementation to prevent similar vulnerabilities
• Monitor system logs for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was resolved by holding a tracked reference to the bound net_device in the socket and serializing bind()/release() with rtnl_lock(). This change prevents the use-after-free race condition by ensuring that the socket is not freed while the NETDEV_UNREGISTER event is being processed. Linux kernel developers and maintainers should verify the patch and review the CAN isotp implementation to prevent similar vulnerabilities. The patch should be applied to the Linux kernel to fix the vulnerability. System logs should be monitored for potential exploitation attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.