Fedora Account System
Red Hat Associate
Red Hat Customer
Use-after-free in CAN BCM due to race between RX operation teardown and thrtimer re-arm in bcm_rx_update_and_send(). can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF Commit f1b4e32aca08 ("can: bcm: use call_rcu() instead of costly synchronize_rcu()") replaced synchronize_rcu() in bcm_delete_rx_op() with call_rcu() and introduced the RX_NO_AUTOTIMER flag.
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:42919 https://access.redhat.com/errata/RHSA-2026:42919
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:43307 https://access.redhat.com/errata/RHSA-2026:43307
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:44694 https://access.redhat.com/errata/RHSA-2026:44694
FYI: Could you please verify the Red Hat Product Errata associations for this bug? Bug 2502866 currently lists the following advisories as addressing CVE-2026-72123: - RHSA-2026:42919 (RHEL 10) - RHSA-2026:43307 (RHEL 9) - RHSA-2026:44694 (RHEL 10.0 EUS) However, the linked advisories do not appear to consistently list CVE-2026-72123. Could you please confirm that the relevant CAN BCM fix is actually included in these kernel updates and that the errata associations are correct? Upstream fix: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=68973f9db761
Correction to my previous comment: Comment 7 was incorrect. The Red Hat Product Errata associations listed in this bug are valid. Please disregard my previous comment. Sorry for the confusion.