CVE-2026-72124

A flaw was found in the Linux kernel's Controller Area Network (CAN) ISO-TP (transport protocol) module. A race condition in the transmit (TX) state machine allows for unsynchronized state transitions. This can lead to a situation where a frame or timer callback operates on an outdated state, resulting in the corruption of unrelated data transfers. This vulnerability could impact the integrity and reliability of CAN communications.

This vulnerability is rated as having Moderate impact for Red Hat products because exploitation requires local privileges to open CAN ISO-TP sockets, and the resulting impact is confined to transport-level data corruption or denial of service rather than broader system compromise. The CAN ISO-TP protocol module is not loaded or used in standard enterprise server environments by default, restricting exposure primarily to specialized embedded or automotive deployments such as Red Hat In-Vehicle OS. Systems that do not configure or interact with CAN bus interfaces remain unaffected under typical operational profiles.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.