In the Linux kernel, the following vulnerability has been resolved:
can: bcm: add missing rcu list annotations and operations
sashiko-bot remarked the missing use of listaddrcu() in bcm_[rx|tx]setup() to have a proper initialized bcmop structure when bcmprocshow() traverses the bcmop's under rcuread_lock().
To cover all initial settings of the bcmop's the listadd_rcu() calls are moved to the end of the setup code.
While at it, also fix the mirroring removal side: bcmrelease() called bcmremoveop() - which frees the op via callrcu() - on ops that were still linked in bo->txops/bo->rxops, without listdelrcu() first. Unlink each op with listdelrcu() before handing it to bcmremoveop(), matching the existing pattern in bcmdeletetxop()/bcmdeleterxop().
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72120.json"
}