In the Linux kernel, the following vulnerability has been resolved:
can: bcm: add missing device refcount for CAN filter removal
sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is present in the bcm.c code. A former fix for raw.c commit c275a176e4b6 ("can: raw: add missing refcount for memory leak fix") introduced a netdevice_tracker which solves the issue for bcm.c too.
bcm_release(), bcm_delete_rx_op() and bcm_notifier() relied on dev_get_by_index(ifindex) to re-find the device for an rx_op before unregistering its filter. If a concurrent NETDEV_UNREGISTER has already unlisted the device from the ifindex table, that lookup fails and can_rx_unregister() is silently skipped, leaving a stale CAN filter pointing at the soon-to-be-freed bcm_op/socket.
Hold a netdev_hold()/netdev_put() tracked reference on op->rx_reg_dev from the moment the rx filter is registered in bcm_rx_setup() until it is unregistered in bcm_rx_unreg(), and use that reference directly in bcm_release() and bcm_delete_rx_op() instead of re-looking the device up by ifindex.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-livepatch-6.12.103-127.188Upgrade kernel6.12-headersUpgrade kernel6.12-modules-extraUpgrade perf6.12Upgrade kernel6.12Upgrade kernel6.12-develUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-tools-debuginfoUpgrade bpftool6.12-debuginfoUpgrade perf6.12-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64Upgrade python3-perf6.12-debuginfoUpgrade python3-perf6.12Upgrade kernel6.12-debuginfoUpgrade kernel6.12-toolsUpgrade bpftool6.12Upgrade kernel6.12-tools-develUpgrade kernel6.12-modules-extra-common | Sep 1, 2026 | Aug 15, 2026 |
| Debian | — | Upgrade linuxUpgrade linux-6.12 | Aug 16, 2026 | Aug 16, 2026 |
| Redhat_linux | — | No solution exists | Aug 19, 2026 | Aug 15, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 25, 2026 | Aug 15, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub