Executive brief
The Linux kernel's CAN ISO-TP protocol implementation contains a race condition in socket release that can cause a timer callback to execute on freed memory. An attacker with local access to the system can trigger this by closing CAN sockets while network devices are being unregistered, resulting in a kernel crash or potential code execution. This affects systems using CAN (Controller Area Network) communication, commonly found in automotive and industrial equipment.
Technical details
A use-after-free vulnerability exists in the isotp_release() function within the CAN ISO-TP protocol handler (net/can/isotp.c). The root cause is a race condition between isotp_notify() (which unregisters RCU filters and clears the so->bound flag without waiting for a grace period) and isotp_release() (which conditionally calls synchronize_rcu() only if so->bound is set). When a NETDEV_UNREGISTER event fires first, isotp_release() skips the synchronize_rcu() call, allowing it to cancel timers while in-flight isotp_rcv() callbacks are still executing and attempting to re-arm the receive timer. This leads to a use-after-free when the timer callback executes on the freed socket. The fix makes isotp_release() unconditionally call synchronize_rcu() before cancelling any timers, ensuring in-flight RCU readers complete before cleanup proceeds. Local attack vector; no authentication or network access required.
Affected products
- Linux Linux kernel Multiple versions; patch applied to stable branches linux-5.10.y through linux-7.2.y and mainline
Timeline
- 2026-08-15: disclosed: CVE-2026-72126 published
- 2026-07-12: patched: Patch committed upstream (commit 9b1a02e0d980ac6b0e36a90378f847062f81d7e4)
- 2026-07-24: patched: Patch applied to stable kernel branches