Executive brief
The Linux kernel's CAN ISOTP protocol implementation contained timing and synchronization issues that could lead to race conditions during message transmission and socket closure. These bugs could cause message corruption, resource leaks, or application hangs when CAN ISOTP sockets are used concurrently. This patch addresses ordering issues in timer handling, thread wakeup logic, and transfer state management to ensure safe concurrent access.
Technical details
The vulnerability encompasses multiple race conditions in the CAN ISOTP (ISO 15765-2) socket implementation: improper timer drain order allowing stale callbacks to re-arm timers, missing wakeups during socket release causing threads to block indefinitely, and incorrect handling of concurrent transfers when multiple threads use the same socket. The root causes involve insufficient synchronization between the txfrtimer/echotimer teardown and the wait_event_interruptible() calls, as well as weak ordering assumptions around tx_gen/tx_state accesses. An attacker with local access to a CAN ISOTP socket can trigger these race conditions by opening concurrent send operations or rapidly closing sockets, leading to kernel state corruption, deadlocks, or potential information disclosure. The fix reorders timer drains, adds proper shutdown signaling, and ensures correct memory ordering of state transitions using acquire semantics.
Affected products
- Linux Linux kernel versions prior to the patch addressing CVE-2026-80889
Timeline
- 2026-09-04: disclosed