CVE-2026-72115

A flaw was found in the Linux kernel's Controller Area Network (CAN) Broadcast Manager (BCM) module. A race condition can occur when an ANYDEV receive operation, which listens on all interfaces, has an active timeout or throttle timer and receives matching frames from multiple network interfaces simultaneously. This concurrency can lead to incorrect timeout notifications and corruption of received frame data, potentially resulting in a Denial of Service (DoS) for the CAN bus communication.

This vulnerability is rated as having a Moderate impact because exploitation requires local access alongside a specific environment utilizing multiple CAN network interfaces. Controller Area Network interfaces are not configured by default in standard Red Hat Enterprise Linux deployments, substantially reducing exposure for mainstream server and cloud environments. The flaw results in data corruption or denial of service limited to CAN subsystem communications, without granting arbitrary code execution or unauthorized privilege elevation across the host system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.