CVE-2026-80889

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ISO Transport (ISOTP) implementation for CAN bus. The problem involves incorrect timer drain order, improper wakeup handling, and issues with tx gen ordering. Specifically, the isotp sendmsg() function may fail to drain so->txfrtimer correctly, allowing stale callbacks to re-arm the echotimer. Additionally, isotp release() may leave a sleeping sendmsg() claim stranded if so->wait is not woken after an ISOTP SHUTDOWN. There are also race conditions where a weakly ordered CPU could pair a fresh tx.state with a stale tx gen or tx result slot in the isotp tx gen done() and isotp tx timeout() functions. The issue also affects how sk err is drained via sock error() in isotp sendmsg() and how lock-free accesses to so->tx.state, rx.state, and cfecho are handled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.