CVE-2026-72116: can: bcm: fix stale rx/tx ops after device removal

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: fix stale rx/tx ops after device removal

RX: an RX_SETUP update(!) for an existing op skipped can_rx_register()
unconditionally, even when a concurrent NETDEV_UNREGISTER had already
torn down its registration (op->rx_reg_dev == NULL). This silently
did not re-enable frame delivery for that updated filter. bcm_rx_setup()
now re-registers in that case, while leaving rx_ops with ifindex = 0
(all CAN devices) which never carry a tracked rx_reg_dev registered as-is.

TX: bcm_notify() only handled bo->rx_ops on NETDEV_UNREGISTER, leaving
tx_ops with an active cyclic transmission re-arming its hrtimer
indefinitely to execute bcm_tx_timeout_handler(). Cancelling the hrtimer
prevents the runaway timer and any injection into a later reused ifindex,
since nothing else calls bcm_can_tx() for the op until an explicit
TX_SETUP update re-arms it.

Unlike bcm_rx_unreg(), which clears the tracked rx_reg_dev for rx_ops,
the ifindex is intentionally left unchanged for tx_ops. bcm_tx_setup()
always rejects ifindex 0, so clearing it would strand the op: neither a
later TX_SETUP (bcm_find_op()) nor TX_DELETE (bcm_delete_tx_op()) could
ever find it again, since both require an exact ifindex match.

The Linux kernel CVE team has assigned CVE-2026-72116 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.25 with commit ffd980f976e7fd666c2e61bf8ab35107efd11828 and fixed in 6.6.148 with commit 60d8a7942f4ed2d975207aaeba1adb576707e53d
	Issue introduced in 2.6.25 with commit ffd980f976e7fd666c2e61bf8ab35107efd11828 and fixed in 6.12.101 with commit f749e4564952d60e96930c09f2be99955d07c22e
	Issue introduced in 2.6.25 with commit ffd980f976e7fd666c2e61bf8ab35107efd11828 and fixed in 6.18.42 with commit 6be3e1fedf03eab36a2c09d755d1171287b2014b
	Issue introduced in 2.6.25 with commit ffd980f976e7fd666c2e61bf8ab35107efd11828 and fixed in 7.1.5 with commit b31d0933509c5a35c0be5736a2ce8df0d1bf112c
	Issue introduced in 2.6.25 with commit ffd980f976e7fd666c2e61bf8ab35107efd11828 and fixed in 7.2-rc4 with commit 3b762c0d950383ab7a002686c9136b9aa55d2d70

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72116
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/can/bcm.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/60d8a7942f4ed2d975207aaeba1adb576707e53d
	https://git.kernel.org/stable/c/f749e4564952d60e96930c09f2be99955d07c22e
	https://git.kernel.org/stable/c/6be3e1fedf03eab36a2c09d755d1171287b2014b
	https://git.kernel.org/stable/c/b31d0933509c5a35c0be5736a2ce8df0d1bf112c
	https://git.kernel.org/stable/c/3b762c0d950383ab7a002686c9136b9aa55d2d70