CVE-2026-72120
In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu list annotations and operations sashiko-bot remarked the missing use of list_add_rcu() in bcm_[rx|tx]_setup() to have a proper initialized bcm_op structure when bcm_proc_show() traverses the bcm_op's under rcu_read_lock(). To cover all initial settings of the bcm_op's the list_add_rcu() calls are moved to the end of the setup code. While at it, also fix the mirroring removal side: bcm_release() called bcm_remove_op() - which frees the op via call_rcu() - on ops that were still linked in bo->tx_ops/bo->rx_ops, without list_del_rcu() first. Unlink each op with list_del_rcu() before handing it to bcm_remove_op(), matching the existing pattern in bcm_delete_tx_op()/bcm_delete_rx_op().
Affected versions
Linux kernel versions
5.10.238,
5.15.185,
6.1.141,
6.6.93,
6.12.31,
5.4.294,
6.14.9,
6.15
and later are affected. Fixed in
5.10.261,
5.15.212,
6.1.178,
6.6.145,
6.12.97,
6.18.40,
7.1.5,
7.2-rc4
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-72120?
CVE-2026-72120 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.10.238 onward and has been patched in 5.10.261, 5.15.212, 6.1.178 and others. CVE-2026-72120 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-72120?
Yes. CVE-2026-72120 has been patched. Fixed versions include 5.10.261, 5.15.212, 6.1.178 and others. If you are running Linux kernel 5.10.238 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-72120 actively exploited?
No. CVE-2026-72120 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.