01 Record

CVE-2026-72120

can: bcm: add missing rcu list annotations and operations

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

can: bcm: add missing rcu list annotations and operations

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.16% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 5.7% of scored records. A rank, not a probability.

NVD base score

7.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Received. NVD last modified this record on 2026-10-16.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published: 2026-08-15 05:52Z2 MO AGO
Last updated: 2026-10-16 18:44Z13 DAYS AGO
Reserved: 2026-08-09
Assigning CNA: Linux
Record state: PUBLISHED
Severity: High (CVSS 7.8)
CNA CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: No CWE assigned
Data version: 5.2
Document digest: 88451953655f3af6fbd50014c9cc1c352f2b2a960d49ec8b8d1df8180f123a09

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux659701c0b954ccdb4a916a4ad59bbc16e726d42c to < 8357255e56dc1aaa437e3c53ee9385de984e0d57, 0622846db728a5332b917c797c733e202c4620ae to < 8e1c7257c81577130f5ce90f69b2a2c3ce63f957, 6d7d458c41b98a5c1670cbd36f2923c37de51cf5 to < eb1c26eab4d1f0b4450439b4b88c3e73faf1da98, 1f912f8484e9c4396378c39460bbea0af681f319 to < f53bdab85e64eb57d6899a30d1307fd5a3639cc7, 63567ecd99a24495208dc860d50fb17440043006 to < 4e22e8b505f877573bbdfdbcb680babad9b2f7a1, dac5e6249159ac255dad9781793dbe5908ac9ddb to < b06a4a397ac826603f39875cb7c7819a41365196, dac5e6249159ac255dad9781793dbe5908ac9ddb to < 30f7bb922cb7e7f072a56c7cb7a5efccd2ceca1d, dac5e6249159ac255dad9781793dbe5908ac9ddb to < 7b2c3eabc4dafc062a25e10711154f2107526a78, 19f553a1ddf260da6570ed8f8d91a8c87f49b63a, 7c9db92d5f0eadca30884af75c53d601edc512ee, 5.10.238 to < 5.10.261, 5.15.185 to < 5.15.212, 6.1.141 to < 6.1.178, 6.6.93 to < 6.6.145, 6.12.31 to < 6.12.97, 5.4.294 to < 5.5, 6.14.9 to < 6.15, 6.15—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/8357255e56dc1aaa437e3c53ee9385de984e0d57
git.kernel.orghttps://git.kernel.org/stable/c/8e1c7257c81577130f5ce90f69b2a2c3ce63f957
git.kernel.orghttps://git.kernel.org/stable/c/eb1c26eab4d1f0b4450439b4b88c3e73faf1da98
git.kernel.orghttps://git.kernel.org/stable/c/f53bdab85e64eb57d6899a30d1307fd5a3639cc7
git.kernel.orghttps://git.kernel.org/stable/c/4e22e8b505f877573bbdfdbcb680babad9b2f7a1
git.kernel.orghttps://git.kernel.org/stable/c/b06a4a397ac826603f39875cb7c7819a41365196
git.kernel.orghttps://git.kernel.org/stable/c/30f7bb922cb7e7f072a56c7cb7a5efccd2ceca1d
git.kernel.orghttps://git.kernel.org/stable/c/7b2c3eabc4dafc062a25e10711154f2107526a78

07 Fixed in

Debian 12

linux
Fixed in 6.1.180-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.100-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.1.5-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.