Linux Kernel CVE-2026-72113

The vulnerability resides in the Linux kernel's CAN BCM socket implementation (net/can/bcm.c), which provides a broadcast manager interface for user-space CAN bus applications to register periodic transmission and receive filters. The root cause is a classic TOCTOU (Time-of-Check-Time-of-Use) race condition: bcm_release(), bcm_delete_rx_op(), and bcm_notifier() each re-looked up the network device by ifindex via dev_get_by_index() before calling can_rx_unregister(). If a concurrent NETDEV_UNREGISTER event had already removed the device from the ifindex table before this lookup, the re-lookup failed silently, can_rx_unregister() was skipped entirely, and the CAN filter was left with a stale pointer to the soon-to-be-freed bcm_op or socket. The fix mirrors the pattern established by commit c275a176e4b6 in can/raw.c, introducing a netdev_tracker via netdev_hold() at filter registration in bcm_rx_setup() and netdev_put() at deregistration in bcm_rx_unreg(), eliminating the re-lookup race entirely. CWE is not formally assigned but this is structurally CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) leading to CWE-416 (Use After Free). CPE data from EUVD identifies the affected product as the Linux kernel from version 2.6.25 through the respective patched stable releases.