{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72126","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-09T03:40:39.907Z","datePublished":"2026-08-15T05:53:03.642Z","dateUpdated":"2026-08-17T05:40:40.020Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:40:40.020Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: isotp: use unconditional synchronize_rcu() in isotp_release()\n\nisotp_notify() unregisters the (RCU) CAN filters via can_rx_unregister()\nand clears so->bound without waiting for a grace period. isotp_release()\nuses so->bound to decide whether it needs to call synchronize_rcu()\nbefore cancelling so->rxtimer, so when NETDEV_UNREGISTER runs first it\nskips that synchronize_rcu() and can cancel the timer while an\nin-flight isotp_rcv() is still executing and about to re-arm it via\nisotp_send_fc(), leading to a use-after-free timer callback on the\nfreed socket.\n\nsakisho-bot remarked a problem with rtnl_lock held in isotp_notify(),\ntherefore make isotp_release() always call synchronize_rcu() before\ncancelling the timers, regardless of so->bound. This still closes the\noriginal race (isotp_notify() clearing so->bound without waiting for\nin-flight isotp_rcv() callers before isotp_release() cancels the RX\ntimer) without adding any RCU wait to the netdevice notifier path."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The UAF is reached through local AF_CAN CAN_ISOTP socket syscalls (socket/bind/close) racing in-kernel ISO-TP RX; a CAN peer can deliver frames, but exploitation requires a local process to close the socket while NETDEV_UNREGISTER clears so->bound.\nAC:L - The attacker controls all race sides: ISO-TP RX traffic via a local CAN socket or bus peer, concurrent close() on the ISOTP socket, and NETDEV_UNREGISTER by deleting the bound vcan/CAN interface (e.g., in a user namespace with CAP_NET_ADMIN).\nPR:L - CAN_ISOTP socket create/bind/sendmsg/close paths impose no CAP_NET_ADMIN check; an unprivileged local user with access to a CAN netdev, including a user-namespace vcan they create, can reach the vulnerable release/timer path.\nUI:N - No victim interaction is required once the attacker can execute local code; they can open the ISO-TP socket, drive RX via CAN frames, delete the netdev, and close the socket to race isotp_rcv() against isotp_release().\nS:U - Exploitation corrupts kernel heap memory within the same OS security boundary (standard kernel UAF), not a VM/host or IOMMU sandbox escape.\nC:H - Use-after-free of struct isotp_sock in isotp_rx_timer_handler reads freed memory (so->rx.state, sock fields), enabling heap grooming for arbitrary kernel memory disclosure per conservative UAF scoring guidance.\nI:H - The timer callback performs writes to fields within the freed isotp_sock/socket object, giving attacker-influenced kernel heap corruption that can be developed into arbitrary write or privilege-escalation primitives.\nA:H - Executing isotp_rx_timer_handler on a freed socket can cause kernel oops/panic or fatal memory corruption; the UAF is reliably triggerable with attacker-controlled timing."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/can/isotp.c"],"versions":[{"version":"22bfa94db2ef6900c790884fa9461486516626e9","lessThan":"945d9894502cd9124f5d676181c542ed2000f7c0","status":"affected","versionType":"git"},{"version":"14a4696bc3118ba49da28f79280e1d55603aa737","lessThan":"59672aa4bcd8d32172c1ff6a179583981d6acabc","status":"affected","versionType":"git"},{"version":"14a4696bc3118ba49da28f79280e1d55603aa737","lessThan":"15413a082df69175c2f96aeab4c26fe1ff7cff03","status":"affected","versionType":"git"},{"version":"14a4696bc3118ba49da28f79280e1d55603aa737","lessThan":"6280eda96e0707264849fa7d036fed873c1f8a6d","status":"affected","versionType":"git"},{"version":"14a4696bc3118ba49da28f79280e1d55603aa737","lessThan":"cb6abc584a1bfab107ac003d64948a4aef1730aa","status":"affected","versionType":"git"},{"version":"14a4696bc3118ba49da28f79280e1d55603aa737","lessThan":"b88a511308779c225005d7994b8744561bdbafbc","status":"affected","versionType":"git"},{"version":"14a4696bc3118ba49da28f79280e1d55603aa737","lessThan":"b8278ff605187ef3fa0f2705e93251cce4c4f8ee","status":"affected","versionType":"git"},{"version":"14a4696bc3118ba49da28f79280e1d55603aa737","lessThan":"9b1a02e0d980ac6b0e36a90378f847062f81d7e4","status":"affected","versionType":"git"},{"version":"80c6ddf771df2ef786f28c1ca5919b3f1080091b","status":"affected","versionType":"git"},{"version":"ebf91625b3e404bd2b4b694c7ee71c1e8f8bd08f","status":"affected","versionType":"git"},{"version":"5.10.50","lessThan":"5.10.261","status":"affected","versionType":"semver"},{"version":"5.12.17","lessThan":"5.13","status":"affected","versionType":"semver"},{"version":"5.13.2","lessThan":"5.14","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/can/isotp.c"],"versions":[{"version":"5.14","status":"affected"},{"version":"0","lessThan":"5.14","status":"unaffected","versionType":"semver"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.50","versionEndExcluding":"5.10.261"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"5.15.212"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.1.178"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"7.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12.17"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/945d9894502cd9124f5d676181c542ed2000f7c0"},{"url":"https://git.kernel.org/stable/c/59672aa4bcd8d32172c1ff6a179583981d6acabc"},{"url":"https://git.kernel.org/stable/c/15413a082df69175c2f96aeab4c26fe1ff7cff03"},{"url":"https://git.kernel.org/stable/c/6280eda96e0707264849fa7d036fed873c1f8a6d"},{"url":"https://git.kernel.org/stable/c/cb6abc584a1bfab107ac003d64948a4aef1730aa"},{"url":"https://git.kernel.org/stable/c/b88a511308779c225005d7994b8744561bdbafbc"},{"url":"https://git.kernel.org/stable/c/b8278ff605187ef3fa0f2705e93251cce4c4f8ee"},{"url":"https://git.kernel.org/stable/c/9b1a02e0d980ac6b0e36a90378f847062f81d7e4"}],"title":"can: isotp: use unconditional synchronize_rcu() in isotp_release()","x_generator":{"engine":"bippy-1.2.0"}}}}