CVE-2026-72121

A flaw was found in the Linux kernel's Controller Area Network (CAN) Broadcom (bcm) driver. A race condition exists when the driver attempts to update filter and timer values simultaneously with ongoing receive operations. This can lead to the transmission of stale CAN reply frames with an incorrect Remote Transmission Request (RTR) flag set, potentially causing incorrect communication or unexpected behavior on the CAN bus.

This vulnerability is rated as Moderate impact because exploitation is restricted to local actors with access to CAN broadcast sockets, confining the risk to denial of service or anomalous frame transmission on configured CAN interfaces. Standard Red Hat Enterprise Linux installations do not configure CAN networking interfaces by default, substantially reducing exposure across typical cloud and enterprise server environments. Additionally, the flaw does not allow remote access, elevation of privileges, or leakage of sensitive kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.