Linux Kernel CVE-2026-72120

The Linux kernel CAN (Controller Area Network) BCM (Broadcast Manager) module, selected via AF_CAN socket family, provides scheduled transmission and filtered reception of CAN frames and exposes operational state through /proc/net/can-bcm. RCU is the kernel's canonical lockless synchronization mechanism: readers hold rcu_read_lock() while writers use list_add_rcu() and list_del_rcu() to enforce correct memory ordering and visibility before grace periods expire. The first defect - using list_add() rather than list_add_rcu() in bcm_[rx|tx]_setup() - violates this contract: bcm_proc_show(), iterating the bcm_op list under rcu_read_lock(), can observe a partially constructed bcm_op before initialization writes are visible to other CPUs. The second defect - bcm_release() calling bcm_remove_op() (call_rcu()-based free) without first calling list_del_rcu() - allows a concurrent RCU reader to dereference an op whose backing memory has entered reclamation. The correct teardown pattern, already present in bcm_delete_tx_op() and bcm_delete_rx_op(), is list_del_rcu() followed by bcm_remove_op(). The fix moves list_add_rcu() to the end of the setup path and applies list_del_rcu() in bcm_release() before any free, restoring consistent RCU discipline across all code paths. No CWE was assigned by NVD; the root cause maps analytically to CWE-362 (Race Condition) and CWE-416 (Use After Free in RCU context).