CVE-2026-72120: can: bcm: add missing rcu list annotations and operations

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: add missing rcu list annotations and operations

sashiko-bot remarked the missing use of list_add_rcu() in
bcm_[rx|tx]_setup() to have a proper initialized bcm_op structure
when bcm_proc_show() traverses the bcm_op's under rcu_read_lock().

To cover all initial settings of the bcm_op's the list_add_rcu() calls
are moved to the end of the setup code.

While at it, also fix the mirroring removal side: bcm_release() called
bcm_remove_op() - which frees the op via call_rcu() - on ops that were
still linked in bo->tx_ops/bo->rx_ops, without list_del_rcu() first.
Unlink each op with list_del_rcu() before handing it to bcm_remove_op(),
matching the existing pattern in bcm_delete_tx_op()/bcm_delete_rx_op().

The Linux kernel CVE team has assigned CVE-2026-72120 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.10.238 with commit 659701c0b954ccdb4a916a4ad59bbc16e726d42c and fixed in 5.10.261 with commit 8357255e56dc1aaa437e3c53ee9385de984e0d57
	Issue introduced in 5.15.185 with commit 0622846db728a5332b917c797c733e202c4620ae and fixed in 5.15.212 with commit 8e1c7257c81577130f5ce90f69b2a2c3ce63f957
	Issue introduced in 6.1.141 with commit 6d7d458c41b98a5c1670cbd36f2923c37de51cf5 and fixed in 6.1.178 with commit eb1c26eab4d1f0b4450439b4b88c3e73faf1da98
	Issue introduced in 6.6.93 with commit 1f912f8484e9c4396378c39460bbea0af681f319 and fixed in 6.6.145 with commit f53bdab85e64eb57d6899a30d1307fd5a3639cc7
	Issue introduced in 6.12.31 with commit 63567ecd99a24495208dc860d50fb17440043006 and fixed in 6.12.97 with commit 4e22e8b505f877573bbdfdbcb680babad9b2f7a1
	Issue introduced in 6.15 with commit dac5e6249159ac255dad9781793dbe5908ac9ddb and fixed in 6.18.40 with commit b06a4a397ac826603f39875cb7c7819a41365196
	Issue introduced in 6.15 with commit dac5e6249159ac255dad9781793dbe5908ac9ddb and fixed in 7.1.5 with commit 30f7bb922cb7e7f072a56c7cb7a5efccd2ceca1d
	Issue introduced in 6.15 with commit dac5e6249159ac255dad9781793dbe5908ac9ddb and fixed in 7.2-rc4 with commit 7b2c3eabc4dafc062a25e10711154f2107526a78
	Issue introduced in 5.4.294 with commit 19f553a1ddf260da6570ed8f8d91a8c87f49b63a
	Issue introduced in 6.14.9 with commit 7c9db92d5f0eadca30884af75c53d601edc512ee

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72120
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/can/bcm.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/8357255e56dc1aaa437e3c53ee9385de984e0d57
	https://git.kernel.org/stable/c/8e1c7257c81577130f5ce90f69b2a2c3ce63f957
	https://git.kernel.org/stable/c/eb1c26eab4d1f0b4450439b4b88c3e73faf1da98
	https://git.kernel.org/stable/c/f53bdab85e64eb57d6899a30d1307fd5a3639cc7
	https://git.kernel.org/stable/c/4e22e8b505f877573bbdfdbcb680babad9b2f7a1
	https://git.kernel.org/stable/c/b06a4a397ac826603f39875cb7c7819a41365196
	https://git.kernel.org/stable/c/30f7bb922cb7e7f072a56c7cb7a5efccd2ceca1d
	https://git.kernel.org/stable/c/7b2c3eabc4dafc062a25e10711154f2107526a78