CVE-2026-72125: can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER

In the Linux kernel, the following vulnerability has been resolved:

can: isotp: fix use-after-free race with concurrent NETDEVUNREGISTER

isotprelease() looked up the bound network device via devgetbyindex() using the stored ifindex. During device unregistration the device is unlisted from the ifindex hash before the NETDEVUNREGISTER notifier chain runs, so a concurrent isotprelease() could find no device, skip canrxunregister() entirely, and still proceed to free the socket. Since isotprelease() had already removed itself from the isotp notifier list at that point, isotpnotify() would never get a chance to clean up either, leaving a stale CAN filter that keeps pointing at the freed socket.

Fix this the same way raw.c already does: hold a tracked reference to the bound netdevice in the socket (so->dev/so->devtracker) from bind() onward instead of re-resolving it from the ifindex, and serialize bind()/release() with rtnllock() so that so->dev is always consistent with what the NETDEVUNREGISTER notifier sees. so->dev stays valid regardless of ifindex-hash unlisting, and is only ever cleared by whichever of isotprelease()/isotpnotify() gets there first, so the filter is always removed exactly once.

isotpbind() now rejects a (re)bind with -EAGAIN while so->[tx|rx].state isn't ISOTPIDLE yet, so a timer left running by a prior NETDEVUNREGISTER can't act on a newly bound so->ifindex. Both checks share the same locksock() section, so there is no window in which a concurrent isotpnotify() clearing so->bound could be missed.