FKIE_CVE-2026-80889

Vulnerability from fkie_nvd - Published: 2026-09-04 18:17 - Updated: 2026-09-04 18:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix timer drain order, wakeup handling and tx_gen ordering This patch is a follow-up to commit cf070fe33bfb ("can: isotp: serialize TX state transitions under so->rx_lock") which addresses following sashiko-bot findings: - isotp_sendmsg(): drain so->txfrtimer first so a stale callback can't re-arm echotimer after the claim - isotp_release(): wake so->wait after forcing ISOTP_SHUTDOWN so a sleeping sendmsg() claim isn't stranded - isotp_sendmsg(): have both wait_event_interruptible() calls in isotp_sendmsg() also wake on ISOTP_SHUTDOWN and do not return claim to IDLE to avoid corrupting a concurrent isotp_release() process. - isotp_sendmsg(): handle potential claim of a new transfer when the wait_event_interruptible() call returns in CAN_ISOTP_WAIT_TX_DONE mode. Don't touch timers and states of the new transfer if a new thread incremented so->tx_gen before getting the lock at err_event_drop. - isotp_sendmsg(): handle a stuck can_send() and omit timer and state changes if a new transfer was claimed. wait_tx_done() returns the error recorded in so->tx_result[], tagged with the caller's own generation. - isotp_tx_timeout(): on a claimed timeout, record the ECOMM error for the timed-out transfer's own generation in so->tx_result[]; sk->sk_err is raised unconditionally, same as every other error path here. - isotp_tx_gen_done()/isotp_tx_timeout(): always read tx.state (acquire) before tx_gen - the reverse order let a weakly ordered CPU pair a fresh tx.state with a stale tx_gen/tx_result slot. - isotp_sendmsg(): wait_tx_done: drain sk_err via sock_error() once we have read the result from so->tx_result[], so an already-reported error doesn't stay latched for a later poll()/SO_ERROR. Also align the remaining lock-free so->tx.state/rx.state/cfecho accesses and use skb->hash as unique loopback echo frame indicator.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/050f010f920da17c1044a4f174766ad553e770b6
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/10be509fa8fd95d1e47d40d1f68b0b26dfe9d572
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2753722612d8824d3910096f93059f669009b0f0
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/35c62ac98d06669aa3f0f38b7829eaca929a611e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8acab9fc66d6f426c36968c91a979f70784945a7
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/af7e25c649ed68cbad07f8185af0f31b892cbf29
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bf5c4a8b24acb12739ebb9aea5510b007e4f5239
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/deca7746b57d982cd4f0301f4443f56780c4a048
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/can/isotp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8acab9fc66d6f426c36968c91a979f70784945a7",
              "status": "affected",
              "version": "bbedeb67a9a684f2fb78c55bd3662c400526715e",
              "versionType": "git"
            },
            {
              "lessThan": "af7e25c649ed68cbad07f8185af0f31b892cbf29",
              "status": "affected",
              "version": "377a8f500704da42ed86a4541ed930e9dcfdb2ea",
              "versionType": "git"
            },
            {
              "lessThan": "2753722612d8824d3910096f93059f669009b0f0",
              "status": "affected",
              "version": "6da8119e8dd542194103139812d1a4b7dcd1aedd",
              "versionType": "git"
            },
            {
              "lessThan": "bf5c4a8b24acb12739ebb9aea5510b007e4f5239",
              "status": "affected",
              "version": "0b05eca9589f609e2491b528dccf683168a4cda8",
              "versionType": "git"
            },
            {
              "lessThan": "deca7746b57d982cd4f0301f4443f56780c4a048",
              "status": "affected",
              "version": "a7d90e7b5e75d7406c889fe36e9a61ee364a00cb",
              "versionType": "git"
            },
            {
              "lessThan": "10be509fa8fd95d1e47d40d1f68b0b26dfe9d572",
              "status": "affected",
              "version": "37beb16e08cae94cc05840c7274225e3b0b38ae7",
              "versionType": "git"
            },
            {
              "lessThan": "35c62ac98d06669aa3f0f38b7829eaca929a611e",
              "status": "affected",
              "version": "4f1fdf1a1c317bcac0c6b6c8e12642c9983de1ca",
              "versionType": "git"
            },
            {
              "lessThan": "050f010f920da17c1044a4f174766ad553e770b6",
              "status": "affected",
              "version": "cf070fe33bfbd1a4c21236078fadb35dd223a157",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/can/isotp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5.10.267",
              "status": "affected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.218",
              "status": "affected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.185",
              "status": "affected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.151",
              "status": "affected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.103",
              "status": "affected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.44",
              "status": "affected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThan": "7.1.8",
              "status": "affected",
              "version": "7.1.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: isotp: fix timer drain order, wakeup handling and tx_gen ordering\n\nThis patch is a follow-up to commit cf070fe33bfb (\"can: isotp: serialize\nTX state transitions under so-\u003erx_lock\") which addresses following\nsashiko-bot findings:\n\n- isotp_sendmsg(): drain so-\u003etxfrtimer first so a stale callback can\u0027t\n  re-arm echotimer after the claim\n\n- isotp_release(): wake so-\u003ewait after forcing ISOTP_SHUTDOWN so a\n  sleeping sendmsg() claim isn\u0027t stranded\n\n- isotp_sendmsg(): have both wait_event_interruptible() calls in\n  isotp_sendmsg() also wake on ISOTP_SHUTDOWN and do not return claim to\n  IDLE to avoid corrupting a concurrent isotp_release() process.\n\n- isotp_sendmsg(): handle potential claim of a new transfer when\n  the wait_event_interruptible() call returns in CAN_ISOTP_WAIT_TX_DONE\n  mode. Don\u0027t touch timers and states of the new transfer if a new thread\n  incremented so-\u003etx_gen before getting the lock at err_event_drop.\n\n- isotp_sendmsg(): handle a stuck can_send() and omit timer and state\n  changes if a new transfer was claimed. wait_tx_done() returns the error\n  recorded in so-\u003etx_result[], tagged with the caller\u0027s own generation.\n\n- isotp_tx_timeout(): on a claimed timeout, record the ECOMM error for\n  the timed-out transfer\u0027s own generation in so-\u003etx_result[]; sk-\u003esk_err\n  is raised unconditionally, same as every other error path here.\n\n- isotp_tx_gen_done()/isotp_tx_timeout(): always read tx.state (acquire)\n  before tx_gen - the reverse order let a weakly ordered CPU pair a fresh\n  tx.state with a stale tx_gen/tx_result slot.\n\n- isotp_sendmsg(): wait_tx_done: drain sk_err via sock_error() once we\n  have read the result from so-\u003etx_result[], so an already-reported error\n  doesn\u0027t stay latched for a later poll()/SO_ERROR.\n\nAlso align the remaining lock-free so-\u003etx.state/rx.state/cfecho accesses\nand use skb-\u003ehash as unique loopback echo frame indicator."
    }
  ],
  "id": "CVE-2026-80889",
  "lastModified": "2026-09-04T18:17:56.910",
  "metrics": {},
  "published": "2026-09-04T18:17:56.910",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/050f010f920da17c1044a4f174766ad553e770b6"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/10be509fa8fd95d1e47d40d1f68b0b26dfe9d572"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2753722612d8824d3910096f93059f669009b0f0"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/35c62ac98d06669aa3f0f38b7829eaca929a611e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8acab9fc66d6f426c36968c91a979f70784945a7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/af7e25c649ed68cbad07f8185af0f31b892cbf29"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/bf5c4a8b24acb12739ebb9aea5510b007e4f5239"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/deca7746b57d982cd4f0301f4443f56780c4a048"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.