CVE-2026-72123

A use-after-free flaw was found in the Linux kernel's CAN BCM (Broadcast Manager) subsystem. During RX operation teardown, a concurrent receive handler can race and re-arm the throttle timer after the operation has been scheduled for deallocation. When the deallocation completes, the timer is still armed and subsequently fires against freed memory, leading to a use-after-free. A local attacker could use this flaw to escalate privileges or cause a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.