CVE-2026-72125 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
isotp_release() looked up the bound network device via dev_get_by_index() using the stored ifindex. During device unregistration the device is unlisted from the ifindex hash before the NETDEV_UNREGISTER notifier chain runs, so a concurrent isotp_release() could find no device, skip can_rx_unregister() entirely, and still proceed to free the socket. Since isotp_release() had already removed itself from the isotp notifier list at that point, isotp_notify() would never get a chance to clean up either, leaving a stale CAN filter that keeps pointing at the freed socket.
Fix this the same way raw.c already does: hold a tracked reference to the bound net_device in the socket (so->dev/so->dev_tracker) from bind() onward instead of re-resolving it from the ifindex, and serialize bind()/release() with rtnl_lock() so that so->dev is always consistent with what the NETDEV_UNREGISTER notifier sees. so->dev stays valid regardless of ifindex-hash unlisting, and is only ever cleared by whichever of isotp_release()/isotp_notify() gets there first, so the filter is always removed exactly once.
isotp_bind() now rejects a (re)bind with -EAGAIN while so->[tx|rx].state
isn't ISOTP_IDLE yet, so a timer left running by a prior NETDEV_UNREGISTER can't act on a newly bound so->ifindex. Both checks share the same lock_sock() section, so there is no window in which a concurrent isotp_notify() clearing so->bound could be missed.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described represents a critical use-after-free condition in the Linux kernel's CAN (Controller Area Network) protocol implementation, specifically within the ISO-TP (ISO 15765-2 Transport Protocol) subsystem. This flaw manifests as a race condition during concurrent network device unregistration and socket release operations, creating potential for memory corruption and system instability. The issue stems from improper synchronization between device management operations and socket cleanup routines, violating fundamental principles of concurrent programming in kernel space.
The technical root cause involves the isotp_release() function's reliance on dev_get_by_index() to resolve network device references using stored interface indexes. During normal device unregistration, the kernel removes devices from the ifindex hash table before executing the NETDEV_UNREGISTER notifier chain. This ordering creates a window where concurrent isotp_release() calls can successfully locate a device that has already been partially unregistered, leading to scenarios where the socket cleanup process bypasses critical CAN filter removal operations. The vulnerability is classified as a use-after-free condition under CWE-416, representing improper deallocation of memory resources.
The operational impact of this vulnerability extends beyond simple memory corruption to potentially compromise system security and stability. When the stale CAN filter continues pointing to freed memory locations, it can lead to unpredictable behavior including kernel panics, denial of service conditions, or even privilege escalation opportunities. The flaw affects the integrity of the kernel's networking subsystem and could be exploited by malicious actors to disrupt network operations or gain unauthorized access to system resources. This vulnerability directly impacts automotive systems, industrial control networks, and any embedded environments relying on CAN protocol communication.
The fix implemented addresses this issue through multiple defensive mechanisms that align with established kernel security practices. The solution introduces tracked references to bound network devices using so->dev and so->dev_tracker fields, eliminating the need for re-resolving device references from potentially unstable ifindex mappings. This approach mirrors existing patterns found in raw.c implementation, demonstrating adherence to proven kernel development methodologies. The fix also incorporates serialization through rtnl_lock() to ensure consistent device state during bind and release operations, preventing race conditions between concurrent operations. Additionally, the implementation introduces validation checks that reject rebind attempts while socket states are not idle, preventing timer-based operations from interfering with newly established connections.
The mitigation strategy follows ATT&CK framework principles for kernel-level defenses by implementing proper synchronization mechanisms and resource management patterns. The solution ensures atomicity of device reference handling through lock_sock() protection and maintains consistency between device state and socket bindings throughout the lifecycle. This approach prevents the scenario where a stale filter persists after device unregistration, thereby eliminating the potential for memory corruption and maintaining system integrity. The fix also incorporates proper cleanup sequencing where only one of the competing cleanup routines (isotp_release() or isotp_notify()) performs the final filter removal, preventing double-free conditions and ensuring complete resource deallocation.
Security implications of this vulnerability extend to systems requiring high availability and safety-critical operations, particularly automotive platforms and industrial automation systems. The use-after-free condition could enable attackers to corrupt kernel memory structures, potentially leading to system crashes or unauthorized code execution. Organizations deploying Linux-based CAN implementations must prioritize applying this fix to maintain system reliability and security posture. The vulnerability highlights the importance of proper synchronization in kernel space programming and demonstrates how seemingly simple device reference management can create complex race conditions with serious security implications.