---
id: CVE-2026-72116
title: 'can: bcm: fix stale rx/tx ops after device removal'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  can: bcm: fix stale rx/tx ops after device removal

  RX: an RX_SETUP update(!) for an existing op skipped can_rx_register()
  unconditionally, even when a concurrent NETDE…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ffd980f976e7fd666c2e61bf8ab35107efd11828 <
    d30a36066ed3abefb72ae18901f71841ba18b350
  - >-
    Linux >= ffd980f976e7fd666c2e61bf8ab35107efd11828 <
    ca829677ffa2de5d79e06366e19ac1e4f5cc78dd
  - >-
    Linux >= ffd980f976e7fd666c2e61bf8ab35107efd11828 <
    9517d8fb0b191398d35b9b7f8c719c1cc7761cb1
  - >-
    Linux >= ffd980f976e7fd666c2e61bf8ab35107efd11828 <
    60d8a7942f4ed2d975207aaeba1adb576707e53d
  - >-
    Linux >= ffd980f976e7fd666c2e61bf8ab35107efd11828 <
    f749e4564952d60e96930c09f2be99955d07c22e
  - >-
    Linux >= ffd980f976e7fd666c2e61bf8ab35107efd11828 <
    6be3e1fedf03eab36a2c09d755d1171287b2014b
  - >-
    Linux >= ffd980f976e7fd666c2e61bf8ab35107efd11828 <
    b31d0933509c5a35c0be5736a2ce8df0d1bf112c
  - >-
    Linux >= ffd980f976e7fd666c2e61bf8ab35107efd11828 <
    3b762c0d950383ab7a002686c9136b9aa55d2d70
  - Linux 2.6.25
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T18:41:52.725992Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:44:56.837Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72116'
references:
  - url: 'https://git.kernel.org/stable/c/d30a36066ed3abefb72ae18901f71841ba18b350'
  - url: 'https://git.kernel.org/stable/c/ca829677ffa2de5d79e06366e19ac1e4f5cc78dd'
  - url: 'https://git.kernel.org/stable/c/9517d8fb0b191398d35b9b7f8c719c1cc7761cb1'
  - url: 'https://git.kernel.org/stable/c/60d8a7942f4ed2d975207aaeba1adb576707e53d'
  - url: 'https://git.kernel.org/stable/c/f749e4564952d60e96930c09f2be99955d07c22e'
  - url: 'https://git.kernel.org/stable/c/6be3e1fedf03eab36a2c09d755d1171287b2014b'
  - url: 'https://git.kernel.org/stable/c/b31d0933509c5a35c0be5736a2ce8df0d1bf112c'
  - url: 'https://git.kernel.org/stable/c/3b762c0d950383ab7a002686c9136b9aa55d2d70'
tags:
  - cve.org
epss: 0.00186
epssPercentile: 0.07635
ingestedAt: '2026-10-16T19:46:24.431Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: fix stale rx/tx ops after device removal

RX: an RX_SETUP update(!) for an existing op skipped can_rx_register()
unconditionally, even when a concurrent NETDEV_UNREGISTER had already
torn down its registration (op->rx_reg_dev == NULL). This silently
did not re-enable frame delivery for that updated filter. bcm_rx_setup()
now re-registers in that case, while leaving rx_ops with ifindex = 0
(all CAN devices) which never carry a tracked rx_reg_dev registered as-is.

TX: bcm_notify() only handled bo->rx_ops on NETDEV_UNREGISTER, leaving
tx_ops with an active cyclic transmission re-arming its hrtimer
indefinitely to execute bcm_tx_timeout_handler(). Cancelling the hrtimer
prevents the runaway timer and any injection into a later reused ifindex,
since nothing else calls bcm_can_tx() for the op until an explicit
TX_SETUP update re-arms it.

Unlike bcm_rx_unreg(), which clears the tracked rx_reg_dev for rx_ops,
the ifindex is intentionally left unchanged for tx_ops. bcm_tx_setup()
always rejects ifindex 0, so clearing it would strand the op: neither a
later TX_SETUP (bcm_find_op()) nor TX_DELETE (bcm_delete_tx_op()) could
ever find it again, since both require an exact ifindex match.

## Affected

- `Linux >= ffd980f976e7fd666c2e61bf8ab35107efd11828 < d30a36066ed3abefb72ae18901f71841ba18b350`
- `Linux >= ffd980f976e7fd666c2e61bf8ab35107efd11828 < ca829677ffa2de5d79e06366e19ac1e4f5cc78dd`
- `Linux >= ffd980f976e7fd666c2e61bf8ab35107efd11828 < 9517d8fb0b191398d35b9b7f8c719c1cc7761cb1`
- `Linux >= ffd980f976e7fd666c2e61bf8ab35107efd11828 < 60d8a7942f4ed2d975207aaeba1adb576707e53d`
- `Linux >= ffd980f976e7fd666c2e61bf8ab35107efd11828 < f749e4564952d60e96930c09f2be99955d07c22e`
- `Linux >= ffd980f976e7fd666c2e61bf8ab35107efd11828 < 6be3e1fedf03eab36a2c09d755d1171287b2014b`
- `Linux >= ffd980f976e7fd666c2e61bf8ab35107efd11828 < b31d0933509c5a35c0be5736a2ce8df0d1bf112c`
- `Linux >= ffd980f976e7fd666c2e61bf8ab35107efd11828 < 3b762c0d950383ab7a002686c9136b9aa55d2d70`
- `Linux 2.6.25`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.