CVE-2026-72120

A flaw was found in the Linux kernel's can: bcm module. Missing Read-Copy-Update (RCU) list annotations and operations can lead to improperly initialized or removed bcm_op structures. This improper handling may cause system instability or a denial of service when these structures are accessed.

This vulnerability is rated Moderate because exploitation requires local system access to create Controller Area Network (CAN) Broadcast Manager sockets, and the maximum impact is limited to a local denial of service via a kernel crash. The CAN subsystem is not required for standard enterprise server workloads and is primarily deployed in automotive or specialized embedded environments. Typical Red Hat Enterprise Linux installations that do not utilize CAN networking hardware or protocols face minimal risk from this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.