SB20260816409 - Race condition in Linux kernel can

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260816409

SB20260816409 - Race condition in Linux kernel can

Published: August 16, 2026

Security Bulletin ID SB20260816409
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Race condition (CVE-ID: CVE-2026-72117)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose incorrect interface and timestamp metadata to user space.

The vulnerability exists due to a race condition in bcm_rx_handler() when processing CAN frames for rx operations subscribed on all interfaces. A local user can trigger concurrent frame handling on different CPUs to disclose incorrect interface and timestamp metadata to user space.

The issue affects rx operations with ifindex set to 0, where the same operation is registered in the shared per-netns wildcard filter list, and torn 64-bit timestamp stores may occur on 32-bit platforms.


Remediation

Install update from vendor's website.

References