CVE-2026-72118

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: fix CAN frame rx/tx statistics

KCSAN detected a data race within the bcmrxhandler() when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs.

Use atomic operations with (signed) long data types to access the statistics in the hot path to fix the KCSAN complaint.

Additionally simplify the update and check of statistics overflow by using the atomic operations in separate bcmupdate[rx|tx]stats() functions. The rx variant runs under bcmrxupdatelock to prevent races when resetting the two rx counters; the tx variant runs under bcmtxlock and only needs to guard its own counter's overflow.

As the rx path resets its values already at LONGMAX / 100, there is no conflict between the two locking domains (bcmrxupdatelock vs. bcmtxlock) even for ops that use both paths.

The rx statistics update and the framesfiltered update in bcmrxchanged() were previously performed in two separate bcmrxupdatelock sections. For an rx op subscribed on all interfaces (ifindex == 0), bcmrxhandler() can run concurrently on different CPUs, so a counter reset by one CPU between these two sections could leave framesfiltered larger than framesabs on another CPU, producing a bogus (even negative) reduction percentage in procfs. Update the statistics in the same critical section as bcmrxchanged() to close this gap, which also removes the now unneeded extra lock/unlock pair around the traffic_flags calculation.