Skip to main content

Linux Kernel CVE-2026-72126

| EUVDEUVD-2026-58884 HIGH
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-5j9g-r9x8-9248
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Race condition requires winning a narrow timing window between NETDEV_UNREGISTER and socket release, justifying AC:H over the NVD-assigned AC:L; all other metrics align with the CVSS description.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 07:06 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
HIGH 7.8
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

can: isotp: use unconditional synchronize_rcu() in isotp_release()

isotp_notify() unregisters the (RCU) CAN filters via can_rx_unregister() and clears so->bound without waiting for a grace period. isotp_release() uses so->bound to decide whether it needs to call synchronize_rcu() before cancelling so->rxtimer, so when NETDEV_UNREGISTER runs first it skips that synchronize_rcu() and can cancel the timer while an in-flight isotp_rcv() is still executing and about to re-arm it via isotp_send_fc(), leading to a use-after-free timer callback on the freed socket.

sakisho-bot remarked a problem with rtnl_lock held in isotp_notify(), therefore make isotp_release() always call synchronize_rcu() before cancelling the timers, regardless of so->bound. This still closes the original race (isotp_notify() clearing so->bound without waiting for in-flight isotp_rcv() callers before isotp_release() cancels the RX timer) without adding any RCU wait to the netdevice notifier path.

AnalysisAI

Use-after-free in the Linux kernel CAN isotp (ISO 15765-2 Transport Protocol) socket subsystem enables a local low-privileged attacker to corrupt freed kernel memory, potentially escalating privileges to root. The race arises because isotp_notify() clears so->bound via can_rx_unregister() without a subsequent RCU grace period, causing isotp_release() to skip synchronize_rcu() and cancel so->rxtimer while an in-flight isotp_rcv() callback is still executing and about to re-arm it via isotp_send_fc(). Multiple Linux stable branches from 5.10 through pre-7.2-rc4 are affected; vendor-released patches are confirmed across eight stable-tree commits. No public exploit identified at time of analysis; EPSS is 0.22% at the 13th percentile.

Technical ContextAI

The CAN isotp subsystem in the Linux kernel provides socket-level access to segmented CAN bus communication per ISO 15765-2, used primarily in automotive and industrial embedded systems. The vulnerability involves a subtle misuse of Linux's RCU (Read-Copy-Update) synchronization: isotp_notify(), the netdevice notifier callback, calls can_rx_unregister() to deregister CAN RX filters and then clears so->bound - but does so without issuing synchronize_rcu() to drain in-flight RCU read-side critical sections. When isotp_release() subsequently checks so->bound and finds it already cleared, it skips its own synchronize_rcu() call and proceeds to cancel so->rxtimer. If isotp_rcv() is still executing within an RCU read-side section and is about to re-arm that timer via isotp_send_fc(), the timer cancellation in isotp_release() races with isotp_rcv(), ultimately producing a use-after-free when the timer fires against an already-freed socket structure. The fix makes isotp_release() call synchronize_rcu() unconditionally before cancelling any timers, eliminating the TOCTOU race on so->bound. CWE is unassigned in NVD but the root cause maps to CWE-362 (Race Condition) compounded by CWE-416 (Use After Free).

RemediationAI

The primary fix is to upgrade to a patched Linux kernel stable release: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc4 (or any later release). Patches are available via the kernel.org stable tree and referenced at https://git.kernel.org/stable/c/15413a082df69175c2f96aeab4c26fe1ff7cff03 and the seven related stable commits listed in the references. Downstream distributions (RHEL, Ubuntu LTS, SUSE) should be monitored for backport availability to their shipped kernel versions. For systems that do not require CAN isotp functionality, blacklisting the can-isotp kernel module is a highly effective compensating control with no side effects on non-CAN workloads: add 'blacklist can-isotp' to /etc/modprobe.d/blacklist.conf and rebuild the initramfs - this eliminates the attack surface entirely but will break any application depending on AF_CAN SOCK_DGRAM CAN_ISOTP sockets. An additional layered mitigation is restricting CAP_NET_RAW capability to only trusted processes and disabling unprivileged user namespaces (sysctl kernel.unprivileged_userns_clone=0 on applicable kernels), which raises the privilege bar for socket creation and reduces the exploitable population to already-elevated local users.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72126 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy