CVE-2026-72126

A flaw was found in the Linux kernel's Controller Area Network (CAN) ISO-TP (isotp) module. This vulnerability arises from a race condition where the isotp_release() function can cancel a timer while it is still actively being used by isotp_rcv(). This can lead to a use-after-free condition, which a local attacker could exploit to cause a denial of service or potentially achieve arbitrary code execution within the kernel.

This vulnerability is rated as Moderate severity for Red Hat products because exploitation requires local access and relies on winning a race condition during network interface unregistration. Controller Area Network (CAN) protocols are rarely enabled or utilized in typical enterprise server deployments, limiting primary exposure to specialized embedded environments such as Red Hat In-Vehicle OS. Consequently, standard server installations face minimal exposure under default configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.