CVE-2026-72117: can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()

For an rx op subscribed on all interfaces (ifindex == 0), the same op
is registered once in the shared per-netns wildcard filter list, so
bcm_rx_handler() can run concurrently on different CPUs for frames
arriving on different net devices.

op->rx_stamp and op->rx_ifindex were written before bcm_rx_update_lock was
taken, allowing concurrent writers to race each other - including a torn
store of the 64-bit rx_stamp on 32-bit platforms.

Beyond a torn store bcm_send_to_user() must report the timestamp/ifindex
of the very same frame whose content it is delivering. So the assignment
is placed in the same unbroken bcm_rx_update_lock section as the content
comparison.

As a side effect, the RTR-request frame feature (which never reach
bcm_send_to_user()) no longer updates rx_stamp/rx_ifindex, since only
the notification path needs them.

The Linux kernel CVE team has assigned CVE-2026-72117 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.25 with commit ffd980f976e7fd666c2e61bf8ab35107efd11828 and fixed in 6.6.148 with commit 5f246b96ab47523ec9b8ea870b5c567a3cb1eb1c
	Issue introduced in 2.6.25 with commit ffd980f976e7fd666c2e61bf8ab35107efd11828 and fixed in 6.12.101 with commit 656ff69ef235699035e57d9e1ae417e62a38aa7f
	Issue introduced in 2.6.25 with commit ffd980f976e7fd666c2e61bf8ab35107efd11828 and fixed in 6.18.42 with commit 136de17f38630307991c59aa7080012a99451783
	Issue introduced in 2.6.25 with commit ffd980f976e7fd666c2e61bf8ab35107efd11828 and fixed in 7.1.5 with commit c312b750bb5ac3348cfc85dab25e90937bd4d251
	Issue introduced in 2.6.25 with commit ffd980f976e7fd666c2e61bf8ab35107efd11828 and fixed in 7.2-rc4 with commit 58fd6cbc8541216af1d7ed272ea7ac2b66d50fd8

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72117
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/can/bcm.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/5f246b96ab47523ec9b8ea870b5c567a3cb1eb1c
	https://git.kernel.org/stable/c/656ff69ef235699035e57d9e1ae417e62a38aa7f
	https://git.kernel.org/stable/c/136de17f38630307991c59aa7080012a99451783
	https://git.kernel.org/stable/c/c312b750bb5ac3348cfc85dab25e90937bd4d251
	https://git.kernel.org/stable/c/58fd6cbc8541216af1d7ed272ea7ac2b66d50fd8