CVE-2026-72113

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: add missing device refcount for CAN filter removal

sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is present in the bcm.c code. A former fix for raw.c commit c275a176e4b6 ("can: raw: add missing refcount for memory leak fix") introduced a netdevice_tracker which solves the issue for bcm.c too.

bcmrelease(), bcmdeleterxop() and bcmnotifier() relied on devgetbyindex(ifindex) to re-find the device for an rxop before unregistering its filter. If a concurrent NETDEVUNREGISTER has already unlisted the device from the ifindex table, that lookup fails and canrxunregister() is silently skipped, leaving a stale CAN filter pointing at the soon-to-be-freed bcm_op/socket.

Hold a netdevhold()/netdevput() tracked reference on op->rxregdev from the moment the rx filter is registered in bcmrxsetup() until it is unregistered in bcmrxunreg(), and use that reference directly in bcmrelease() and bcmdeleterxop() instead of re-looking the device up by ifindex.