01 Record

CVE-2026-72126

can: isotp: use unconditional synchronize_rcu() in isotp_release()

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

can: isotp: use unconditional synchronize_rcu() in isotp_release()

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.17% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 6.4% of scored records. A rank, not a probability.

NVD base score

7.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Received. NVD last modified this record on 2026-10-16.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published: 2026-08-15 05:53Z2 MO AGO
Last updated: 2026-10-16 18:44Z13 DAYS AGO
Reserved: 2026-08-09
Assigning CNA: Linux
Record state: PUBLISHED
Severity: High (CVSS 7.8)
CNA CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: No CWE assigned
Data version: 5.2
Document digest: 57a34bad4ac10659108340b7dd2a0e3cf702c34cf4867853b9caa4aa10c8d006

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux22bfa94db2ef6900c790884fa9461486516626e9 to < 945d9894502cd9124f5d676181c542ed2000f7c0, 14a4696bc3118ba49da28f79280e1d55603aa737 to < 59672aa4bcd8d32172c1ff6a179583981d6acabc, 14a4696bc3118ba49da28f79280e1d55603aa737 to < 15413a082df69175c2f96aeab4c26fe1ff7cff03, 14a4696bc3118ba49da28f79280e1d55603aa737 to < 6280eda96e0707264849fa7d036fed873c1f8a6d, 14a4696bc3118ba49da28f79280e1d55603aa737 to < cb6abc584a1bfab107ac003d64948a4aef1730aa, 14a4696bc3118ba49da28f79280e1d55603aa737 to < b88a511308779c225005d7994b8744561bdbafbc, 14a4696bc3118ba49da28f79280e1d55603aa737 to < b8278ff605187ef3fa0f2705e93251cce4c4f8ee, 14a4696bc3118ba49da28f79280e1d55603aa737 to < 9b1a02e0d980ac6b0e36a90378f847062f81d7e4, 80c6ddf771df2ef786f28c1ca5919b3f1080091b, ebf91625b3e404bd2b4b694c7ee71c1e8f8bd08f, 5.10.50 to < 5.10.261, 5.12.17 to < 5.13, 5.13.2 to < 5.14, 5.14—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/945d9894502cd9124f5d676181c542ed2000f7c0
git.kernel.orghttps://git.kernel.org/stable/c/59672aa4bcd8d32172c1ff6a179583981d6acabc
git.kernel.orghttps://git.kernel.org/stable/c/15413a082df69175c2f96aeab4c26fe1ff7cff03
git.kernel.orghttps://git.kernel.org/stable/c/6280eda96e0707264849fa7d036fed873c1f8a6d
git.kernel.orghttps://git.kernel.org/stable/c/cb6abc584a1bfab107ac003d64948a4aef1730aa
git.kernel.orghttps://git.kernel.org/stable/c/b88a511308779c225005d7994b8744561bdbafbc
git.kernel.orghttps://git.kernel.org/stable/c/b8278ff605187ef3fa0f2705e93251cce4c4f8ee
git.kernel.orghttps://git.kernel.org/stable/c/9b1a02e0d980ac6b0e36a90378f847062f81d7e4

07 Fixed in

Debian 12

linux
Fixed in 6.1.180-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.100-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.1.5-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.