CVE-2026-80889

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

can: isotp: fix timer drain order, wakeup handling and tx_gen ordering

This patch is a follow-up to commit cf070fe33bfb ("can: isotp: serialize

TX state transitions under so->rx_lock") which addresses following

sashiko-bot findings:

- isotp_sendmsg(): drain so->txfrtimer first so a stale callback can't

re-arm echotimer after the claim

- isotp_release(): wake so->wait after forcing ISOTP_SHUTDOWN so a

sleeping sendmsg() claim isn't stranded

- isotp_sendmsg(): have both wait_event_interruptible() calls in

isotp_sendmsg() also wake on ISOTP_SHUTDOWN and do not return claim to

IDLE to avoid corrupting a concurrent isotp_release() process.

- isotp_sendmsg(): handle potential claim of a new transfer when

the wait_event_interruptible() call returns in CAN_ISOTP_WAIT_TX_DONE

mode. Don't touch timers and states of the new transfer if a new thread

incremented so->tx_gen before getting the lock at err_event_dr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References