CVE-2026-80889

isotp sendmsg(): drain so->txfrtimer first so a stale callback can't re-arm echotimer after the claim

isotp release(): wake so->wait after forcing ISOTP SHUTDOWN so a sleeping sendmsg() claim isn't stranded

isotp sendmsg(): have both wait event interruptible() calls in isotp sendmsg() also wake on ISOTP SHUTDOWN and do not return claim to IDLE to avoid corrupting a concurrent isotp release() process.

isotp sendmsg(): handle potential claim of a new transfer when the wait event interruptible() call returns in CAN ISOTP WAIT TX DONE mode. Don't touch timers and states of the new transfer if a new thread incremented so->tx gen before getting the lock at err event drop.

isotp sendmsg(): handle a stuck can send() and omit timer and state changes if a new transfer was claimed. wait tx done() returns the error recorded in so->tx result[], tagged with the caller's own generation.

isotp tx timeout(): on a claimed timeout, record the ECOMM error for the timed-out transfer's own generation in so->tx result[]; sk->sk err is raised unconditionally, same as every other error path here.

isotp tx gen done()/isotp tx timeout(): always read tx.state (acquire) before tx gen - the reverse order let a weakly ordered CPU pair a fresh tx.state with a stale tx gen/tx result slot.

isotp sendmsg(): wait tx done: drain sk err via sock error() once we have read the result from so->tx result[], so an already-reported error doesn't stay latched for a later poll()/SO ERROR.