CVE-2026-72126 Linux CVE debrief

Who should care

Linux kernel developers and users, CAN subsystem maintainers, and security teams responsible for vulnerability management and patching. These stakeholders should review the patch, apply it to their systems, and monitor for potential exploits. They should also review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, they should track exceptions, retest remediated assets, and close the item only after evidence is documented. Linux distribution maintainers and users of Linux-based systems should also be aware of this vulnerability and take necessary actions to mitigate it. Security researchers and penetration testers may also be interested in this vulnerability and its fix, as it could be used to improve the security of Linux-based systems. IT operations teams responsible for patch management and system updates should prioritize this patch and ensure it is applied to all affected systems. Compliance teams should verify that the patch is applied to ensure regulatory requirements are met. The vulnerability's impact on the CAN subsystem and potential for denial-of-service or code execution make it a high-priority patch for Linux kernel developers and users. The Linux community and ecosystem may also be affected by this vulnerability, and stakeholders should be aware of the potential risks and take necessary actions to mitigate them. The vulnerability's resolution demonstrates the importance of proper synchronization and timer management in the Linux kernel, and stakeholders should be aware of these best practices when developing and maintaining Linux-based systems. Overall, a wide range of stakeholders across the Linux ecosystem should be aware of this vulnerability and take necessary actions to mitigate its impact. The vulnerability affects various Linux kernel versions and has been resolved in recent kernel releases. Users and developers should review the official advisory and patch notes to determine the affected versions and apply the necessary patches. The fix has been backported to stable kernel releases, and users should update to the latest stable kernel version to ensure they are protected against this and to

Technical summary

The Linux kernel has a use-after-free vulnerability in the CAN isotp subsystem. The vulnerability is caused by isotp_release() not waiting for a grace period before cancelling the RX timer, allowing an in-flight isotp_rcv() to re-arm the timer after the socket has been freed. This can lead to a use-after-free timer callback on the freed socket. The fix ensures that the RX timer is cancelled after a grace period, preventing a use-after-free timer callback on the freed socket.

Defensive priority

High

Recommended defensive actions

• Apply the patch to update the Linux kernel
• Review and test the patch for your specific use case
• Monitor for any potential exploits of this vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was resolved by making isotp_release() always call synchronize_rcu() before cancelling the timers, regardless of so->bound. This change closes the original race without adding any RCU wait to the netdevice notifier path. The fix ensures that the RX timer is cancelled after a grace period, preventing a use-after-free timer callback on the freed socket. Linux kernel developers should review the patch and test it for their specific use case. The patch is available in the official Linux kernel repository. Users should apply the patch to update the Linux kernel and monitor for any potential exploits of this vulnerability. The vulnerability affects the CAN isotp subsystem, and its exploitation could lead to a denial-of-service or potentially code execution.

Official resources