CVE-2026-72125

CVE-2026-72125 is a use-after-free in the CAN isotp socket layer, and the fix tells you everything you need to know about why this matters. The patch adds reference tracking (so->dev_tracker), rtnl_lock() serialization to bind/release, and a new -EAGAIN rebind guard during device unregistration. That's a three-part fix for what should be a straightforward device-reference bug. The patch note is explicit: fix it the same way raw.c already does. That phrasing is the real vulnerability signal — it means a known, solved concurrency pattern existed elsewhere in the CAN subsystem and was not applied when isotp was written. This isn't an emergent bug from complex interactions; it's a reinvention of a known anti-pattern, which points to structural technical debt rather than a coding error. The UAF itself is straightforward: isotp_release() re-resolves the net_device from ifindex at free time, but device unregistration unlists the device before the notifier chain fires. The window between those events is exploitable. The stale CAN filter is the under-analyzed risk — a freed socket whose filter entry survives in the rx path becomes a write-what-where primitive if an attacker can inject packets on that interface index after free. The CVSS 7.8 may underweight the kernel-context privilege level and total system compromise potential. The deeper concern is whether other CAN protocols (BCM, J1939, TS) carry the same structural gap. If isotp blindly replicated raw.c's bug pattern rather than inheriting it, the subsystem lacks shared infrastructure or enforceable contracts that make race-safe device handling the default. The rtnl_lock() addition may also introduce latency for high-frequency ISOTP use — worth flagging if you're running CAN in real-time automotive contexts. Check your kernel version against the fix commit. Audit any CAN socket implementations you maintain for ifindex re-resolution patterns. Monitor for the new -EAGAIN return on rebind attempts during unregister — that behavior change could break existing applications expecting synchronous bind semantics.

Reviewed through automated stages and approved by a human before publication.