CVE-2026-72123: Software Security Vulnerability Vulnerability

HIGH

Advisory Identifier: GHSA-8862-mgcq-cgrw

CVSS 7.8

Published 2026-08-15

Advisory Summary

CVE-2026-72123 is a HIGH (CVSS 7.8) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-72123 at a Glance

CVE Identifier CVE-2026-72123

GHSA Identifier GHSA-8862-mgcq-cgrw

Severity HIGH

CVSS v3.1 Base Score 7.8

CWE Classification General Security Weakness

Affected Product Software

Package Ecosystem Maven

Published Date 2026-08-15

Last Updated 2026-08-19

Security Impact

CVSS: 7.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Local (AV:L)

Attack Complexity Low (AC:L)

Privileges Required Low (PR:L)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity High (I:H)

Availability High (A:H)

How to Fix CVE-2026-72123

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-72123, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF Commit f1b4e32aca08 ("can: bcm: use call_rcu() instead of costly synchronize_rcu()") replaced synchronize_rcu() in bcm_delete_rx_op() with call_rcu() and introduced the RX_NO_AUTOTIMER flag. However, this flag check was omitted for thrtimer in the packet rx fast-path. During BCM RX operation teardown, a concurrent RCU reader (bcm_rx_handler) can race and re-arm thrtimer via bcm_rx_update_and_send() after call_rcu() has been scheduled. Once the RCU grace period elapses, bcm_op is freed. The subsequently firing thrtimer then dereferences the deallocated op, causing a UAF. Adding flag checks to the rx fast-path (bcm_rx_update_and_send) does not fully close the TOCTOU race and introduces latency for every CAN frame. Conversely, calling hrtimer_cancel() directly inside the RCU callback (softirq context) is fatal as hrtimer_cancel() can sleep, triggering a "scheduling while atomic" panic. Resolve this by deferring the timer cancellation and memory free to a dedicated unbound workqueue (bcm_wq). The RCU callback now queues a work item to bcm_wq, which safely cancels both timers and deallocates memory in sleepable process context. A dedicated workqueue is used to prevent system-wide WQ saturation and is cleanly flushed/destroyed on module unload to avoid rmmod page faults. Since the deferred work can now outlive the calling context by an unbounded amount, also take a reference on op->sk when it is assigned and drop it only once the deferred work has cancelled both timers, so a socket can no longer be freed out from under a still-armed timer whose callback (bcm_send_to_user()) dereferences op->sk.

References

NVD — CVE-2026-72123 NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-72123

git.kernel.org/stable/c/036a8c320c... WEB

https://git.kernel.org/stable/c/036a8c320ca11bc912e8027adcfad14b326f067e

git.kernel.org/stable/c/3cf4fd5316... WEB

https://git.kernel.org/stable/c/3cf4fd5316f449811d8baf1bc6978ef5a7b743a9

git.kernel.org/stable/c/4177762f70... WEB

https://git.kernel.org/stable/c/4177762f70646ac48a2af382e45a795cbd295198

git.kernel.org/stable/c/68973f9db7... WEB

https://git.kernel.org/stable/c/68973f9db76144825e4f35dfdc80fb8279eb2d57

git.kernel.org/stable/c/6fd08e8d82... WEB

https://git.kernel.org/stable/c/6fd08e8d826c3aa4cc7021f5f9cdbb7fa7441d3f

git.kernel.org/stable/c/cd830e0bc2... WEB

https://git.kernel.org/stable/c/cd830e0bc25ee2d38cbfbdbb3cd77c5f53b2b6d5

git.kernel.org/stable/c/ce2d4b121f... WEB

https://git.kernel.org/stable/c/ce2d4b121fb7545e1ed588e860c8e5fd5ad45224

git.kernel.org/stable/c/de5fce4663... WEB

https://git.kernel.org/stable/c/de5fce46637de05bef56ec08528127676eb6fc9b

Frequently Asked Questions

What is CVE-2026-72123?

CVE-2026-72123 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.

Which Software versions are affected?

Affected versions include releases prior to current release patches.

What version fixes CVE-2026-72123?

Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.

What is the CVSS score of CVE-2026-72123?

CVE-2026-72123 has a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

What CWE is associated with CVE-2026-72123?

CVE-2026-72123 is classified under General Security Weakness.

How can I check Maven dependencies for CVE-2026-72123?

Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-8862-mgcq-cgrw",
  "modified" : "2026-08-19T18:32:27Z",
  "published" : "2026-08-15T06:32:12Z",
  "aliases" : [ "CVE-2026-72123" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF\n\nCommit f1b4e32aca08 (\"can: bcm: use call_rcu() instead of costly\nsynchronize_rcu()\") replaced synchronize_rcu() in bcm_delete_rx_op()\nwith call_rcu() and introduced the RX_NO_AUTOTIMER flag.\n\nHowever, this flag check was omitted for thrtimer in the packet rx\nfast-path. During BCM RX operation teardown, a concurrent RCU reader\n(bcm_rx_handler) can race and re-arm thrtimer via\nbcm_rx_update_and_send() after call_rcu() has been scheduled.  Once\nthe RCU grace period elapses, bcm_op is freed.  The subsequently\nfiring thrtimer then dereferences the deallocated op, causing a UAF.\n\nAdding flag checks to the rx fast-path (bcm_rx_update_and_send) does not\nfully close the TOCTOU race and introduces latency for every CAN frame.\nConversely, calling hrtimer_cancel() directly inside the RCU callback\n(softirq context) is fatal as hrtimer_cancel() can sleep, triggering\na \"scheduling while atomic\" panic.\n\nResolve this by deferring the timer cancellation and memory free to a\ndedicated unbound workqueue (bcm_wq).  The RCU callback now queues a\nwork item to bcm_wq, which safely cancels both timers and deallocates\nmemory in sleepable process context.  A dedicated workqueue is used to\nprevent system-wide WQ saturation and is cleanly flushed/destroyed\non module unload to avoid rmmod page faults.\n\nSince the deferred work can now outlive the calling context by an\nunbounded amount, also take a reference on op->sk when it is assigned\nand drop it only once the deferred work has cancelled both timers, so a\nsocket can no longer be freed out from under a still-armed timer whose\ncallback (bcm_send_to_user()) dereferences op->sk.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-72123"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/036a8c320ca11bc912e8027adcfad14b326f067e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3cf4fd5316f449811d8baf1bc6978ef5a7b743a9"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4177762f70646ac48a2af382e45a795cbd295198"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/68973f9db76144825e4f35dfdc80fb8279eb2d57"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6fd08e8d826c3aa4cc7021f5f9cdbb7fa7441d3f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/cd830e0bc25ee2d38cbfbdbb3cd77c5f53b2b6d5"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ce2d4b121fb7545e1ed588e860c8e5fd5ad45224"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/de5fce46637de05bef56ec08528127676eb6fc9b"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-15T06:21:29Z"
  }
}

CVSS V3

7.8 HIGH