CVE-2026-72113

A flaw was found in the Linux kernel's Controller Area Network (CAN) Broadcast Manager (BCM) module. This vulnerability arises from a missing device reference count during the removal of CAN filters. If a network device is unregistered concurrently while the BCM module attempts to remove a filter, the filter may persist and point to memory that has already been deallocated. This could allow a local attacker to trigger a use-after-free condition, potentially leading to a system crash (denial of service) or, in some scenarios, arbitrary code execution.

CAN BCM filter removal can leave a stale receive filter when bcm_release or bcm_delete_rx_op tries to re-find the net device by ifindex after a concurrent NETDEV_UNREGISTER already unlisted it. The stale filter can keep a callback with a pointer to a soon-to-be-freed bcm_op or socket, making this a race based use-after-free candidate rather than a simple leak. For the CVSS the PR:L is used for the paranoid score because a local user or reduced capability network admin context may be able to create CAN_BCM state and race device removal in a namespace or managed environment. The issue is not directly reachable over an IP network. External CAN bus traffic alone is not sufficient without the local kernel state and unregister race. Impact is at least local denial of service via crash and in the worst case may allow confidentiality or integrity impact due to use-after-free memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.