01 Record

CVE-2026-72121

can: bcm: add locking when updating filter and timer values

HighPUBLISHEDCNA: Linux

CNA base score8.8 CVSS v3.xCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

can: bcm: add locking when updating filter and timer values

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.35% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 28.8% of scored records. A rank, not a probability.

NVD base score

8.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Received. NVD last modified this record on 2026-10-16.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published: 2026-08-15 05:52Z2 MO AGO
Last updated: 2026-10-16 18:44Z13 DAYS AGO
Reserved: 2026-08-09
Assigning CNA: Linux
Record state: PUBLISHED
Severity: High (CVSS 8.8)
CNA CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: No CWE assigned
Data version: 5.2
Document digest: 9529267602c44dfba97a5769282fe8268b4b15478f1a6e4e64b239020225479c

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux7595de7bc56e0e52b74e56c90f7e247bf626d628 to < 96994180bd7b248b0cc698afe926e23fc1bda59b, fbd8fdc2b218e979cfe422b139b8f74c12419d1f to < caa8704a7f3cb7806331596195385437126ecb3a, 2a437b86ac5a9893c902f30ef66815bf13587bf6 to < a7c369e7da8203e2b5be12bbcac7b9ab2ed5b658, 76c84c3728178b2d38d5604e399dfe8b0752645e to < a7eb6db1cd3f7b556a301dc1265945ad112089f7, cc55dd28c20a6611e30596019b3b2f636819a4c0 to < 834cbca3b12e46887f7a9b35f1981a888360ea4c, c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 to < 19b1994069dd29478ba767de1f98f14a088198dc, c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 to < fc9f5ee1b073bd233d9c604e338af4ebb42cbc33, c2aba69d0c36a496ab4f2e81e9c2b271f2693fd7 to < 749179c2e25b95d22499ed29096b3e02d6dfd2b4, 8f1c022541bf5a923c8d6fa483112c15250f30a4, c4e8a172501e677ebd8ea9d9161d97dc4df56fbd, 5.10.238 to < 5.10.265, 5.15.185 to < 5.15.216, 6.1.141 to < 6.1.183, 6.6.93 to < 6.6.148, 6.12.31 to < 6.12.101, 5.4.294 to < 5.5, 6.14.9 to < 6.15, 6.15—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/96994180bd7b248b0cc698afe926e23fc1bda59b
git.kernel.orghttps://git.kernel.org/stable/c/caa8704a7f3cb7806331596195385437126ecb3a
git.kernel.orghttps://git.kernel.org/stable/c/a7c369e7da8203e2b5be12bbcac7b9ab2ed5b658
git.kernel.orghttps://git.kernel.org/stable/c/a7eb6db1cd3f7b556a301dc1265945ad112089f7
git.kernel.orghttps://git.kernel.org/stable/c/834cbca3b12e46887f7a9b35f1981a888360ea4c
git.kernel.orghttps://git.kernel.org/stable/c/19b1994069dd29478ba767de1f98f14a088198dc
git.kernel.orghttps://git.kernel.org/stable/c/fc9f5ee1b073bd233d9c604e338af4ebb42cbc33
git.kernel.orghttps://git.kernel.org/stable/c/749179c2e25b95d22499ed29096b3e02d6dfd2b4

07 Fixed in

Debian 12

linux
Fixed in 6.1.187-1
linux-6.12
Fixed in 6.12.101-1~deb12u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.101-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.1.5-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.