Race condition in Linux kernel - CVE-2026-72117

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU143473

Race condition in Linux kernel - CVE-2026-72117

Published: August 16, 2026


Vulnerability identifier: #VU143473
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-72117
CWE-ID: CWE-362
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to disclose incorrect interface and timestamp metadata to user space.

The vulnerability exists due to a race condition in bcm_rx_handler() when processing CAN frames for rx operations subscribed on all interfaces. A local user can trigger concurrent frame handling on different CPUs to disclose incorrect interface and timestamp metadata to user space.

The issue affects rx operations with ifindex set to 0, where the same operation is registered in the shared per-netns wildcard filter list, and torn 64-bit timestamp stores may occur on 32-bit platforms.


Affected software

Linux kernel
Ubuntu
linux-nvidia (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)

How to mitigate CVE-2026-72117

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-nvidia (Ubuntu package) - addressed in versions 5.15.0-1112.113, 5.15.0.1112.112
linux-gcp-7.0 (Ubuntu package) - addressed in versions 7.0.0-38.38~24.04.4, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14~24.04.1
linux-azure-7.0 (Ubuntu package) - addressed in versions 7.0.0-1016.16~24.04.1, 7.0.0-1017.17~24.04.1

External References

Related Security Bulletins