CVE-2026-72123: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF

CVE-2026-72123: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF

Commit f1b4e32aca08 ("can: bcm: use call_rcu() instead of costly
synchronize_rcu()") replaced synchronize_rcu() in bcm_delete_rx_op()
with call_rcu() and introduced the RX_NO_AUTOTIMER flag.

However, this flag check was omitted for thrtimer in the packet rx
fast-path. During BCM RX operation teardown, a concurrent RCU reader
(bcm_rx_handler) can race and re-arm thrtimer via
bcm_rx_update_and_send() after call_rcu() has been scheduled.  Once
the RCU grace period elapses, bcm_op is freed.  The subsequently
firing thrtimer then dereferences the deallocated op, causing a UAF.

Adding flag checks to the rx fast-path (bcm_rx_update_and_send) does not
fully close the TOCTOU race and introduces latency for every CAN frame.
Conversely, calling hrtimer_cancel() directly inside the RCU callback
(softirq context) is fatal as hrtimer_cancel() can sleep, triggering
a "scheduling while atomic" panic.

Resolve this by deferring the timer cancellation and memory free to a
dedicated unbound workqueue (bcm_wq).  The RCU callback now queues a
work item to bcm_wq, which safely cancels both timers and deallocates
memory in sleepable process context.  A dedicated workqueue is used to
prevent system-wide WQ saturation and is cleanly flushed/destroyed
on module unload to avoid rmmod page faults.

Since the deferred work can now outlive the calling context by an
unbounded amount, also take a reference on op->sk when it is assigned
and drop it only once the deferred work has cancelled both timers, so a
socket can no longer be freed out from under a still-armed timer whose
callback (bcm_send_to_user()) dereferences op->sk.

The Linux kernel CVE team has assigned CVE-2026-72123 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.19 with commit f1b4e32aca0811aa011c76e5d6cf2fa19224b386 and fixed in 6.1.178 with commit 3cf4fd5316f449811d8baf1bc6978ef5a7b743a9
	Issue introduced in 5.19 with commit f1b4e32aca0811aa011c76e5d6cf2fa19224b386 and fixed in 6.6.145 with commit 4177762f70646ac48a2af382e45a795cbd295198
	Issue introduced in 5.19 with commit f1b4e32aca0811aa011c76e5d6cf2fa19224b386 and fixed in 6.12.97 with commit 6fd08e8d826c3aa4cc7021f5f9cdbb7fa7441d3f
	Issue introduced in 5.19 with commit f1b4e32aca0811aa011c76e5d6cf2fa19224b386 and fixed in 6.18.40 with commit cd830e0bc25ee2d38cbfbdbb3cd77c5f53b2b6d5
	Issue introduced in 5.19 with commit f1b4e32aca0811aa011c76e5d6cf2fa19224b386 and fixed in 7.1.5 with commit ce2d4b121fb7545e1ed588e860c8e5fd5ad45224
	Issue introduced in 5.19 with commit f1b4e32aca0811aa011c76e5d6cf2fa19224b386 and fixed in 7.2-rc4 with commit 68973f9db76144825e4f35dfdc80fb8279eb2d57
	Issue introduced in 4.19.252 with commit fbac09a3b8890003c0c55294c00709f3ae5501bb
	Issue introduced in 5.4.205 with commit 5b48f5711f1c630841ab78dcc061de902f0e37bf
	Issue introduced in 5.10.130 with commit 85cd41070df992d3c0dfd828866fdd243d3b774a
	Issue introduced in 5.15.54 with commit f34f2a18e47b73e48f90a757e1f4aaa8c7d665a1
	Issue introduced in 5.18.11 with commit edb4baffb9483141a50fb7f7146cfe4a4c0c2db8

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72123
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/can/bcm.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3cf4fd5316f449811d8baf1bc6978ef5a7b743a9
	https://git.kernel.org/stable/c/4177762f70646ac48a2af382e45a795cbd295198
	https://git.kernel.org/stable/c/6fd08e8d826c3aa4cc7021f5f9cdbb7fa7441d3f
	https://git.kernel.org/stable/c/cd830e0bc25ee2d38cbfbdbb3cd77c5f53b2b6d5
	https://git.kernel.org/stable/c/ce2d4b121fb7545e1ed588e860c8e5fd5ad45224
	https://git.kernel.org/stable/c/68973f9db76144825e4f35dfdc80fb8279eb2d57