CVE-2026-72122

This CVE exposes a race condition in the CAN bus networking subsystem where a compound invariant — two related fields that must be read together — was checked across a synchronization boundary. The bug lives in the broadcast manager (bcm) code path where a reader checks bo->bound locklessly, then uses bo->ifindex without holding the lock, assuming that ifindex is stable when bound is true. The problem: every writer updates these fields independently under lock, meaning a reader can observe them torn against each other — bound is true but ifindex is stale or zero. What makes this worth your attention is not the individual bug but the pattern it represents. The developer performed a compound state check (bound tells you how to interpret ifindex) while reading each field under different synchronization guarantees. This is a common anti-pattern in kernel code: lockless optimizations applied reflexively to fast paths without measured evidence that the lock acquisition actually mattered. The fix correctly moves the ifindex read and a re-check of bo->bound inside the lock, eliminating the torn-read window entirely. Check your systems for this pattern: any code path where one field's value determines how you interpret a second field, and those fields are read without a common lock, is suspect. Review CAN bus socket code and any driver using the bcm interface. If you're maintaining kernel code, resist the urge to add lockless reads to hot paths based on intuition — profile first, then optimize. The deeper concern: this race produces silent semantic corruption rather than a crash. The socket believes it has a valid subscription when it doesn't, and every subsequent CAN frame is either misrouted or discarded with no error logged. In vehicle or industrial deployments where CAN bus interfaces with physical systems, this creates a hazard where the software appears to work but is actually disconnected from the hardware it controls. Treat silent failures in hardware-adjacent code paths as reliability bugs, not just security issues — they mask exactly the kind of state corruption this race creates.

Reviewed through automated stages and approved by a human before publication.