CVE-2026-80889: can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
In the Linux kernel, the following vulnerability has been resolved:
can: isotp: fix timer drain order, wakeup handling and txgen ordering
This patch is a follow-up to commit cf070fe33bfb ("can: isotp: serialize TX state transitions under so->rxlock") which addresses following sashiko-bot findings:
- isotpsendmsg(): drain so->txfrtimer first so a stale callback can't re-arm echotimer after the claim
- isotprelease(): wake so->wait after forcing ISOTPSHUTDOWN so a sleeping sendmsg() claim isn't stranded
- isotpsendmsg(): have both waiteventinterruptible() calls in isotpsendmsg() also wake on ISOTPSHUTDOWN and do not return claim to IDLE to avoid corrupting a concurrent isotprelease() process.
- isotpsendmsg(): handle potential claim of a new transfer when the waiteventinterruptible() call returns in CANISOTPWAITTXDONE mode. Don't touch timers and states of the new transfer if a new thread incremented so->txgen before getting the lock at erreventdrop.
- isotpsendmsg(): handle a stuck cansend() and omit timer and state changes if a new transfer was claimed. waittxdone() returns the error recorded in so->txresult[], tagged with the caller's own generation.
- isotptxtimeout(): on a claimed timeout, record the ECOMM error for the timed-out transfer's own generation in so->txresult[]; sk->skerr is raised unconditionally, same as every other error path here.
- isotptxgendone()/isotptxtimeout(): always read tx.state (acquire) before txgen - the reverse order let a weakly ordered CPU pair a fresh tx.state with a stale txgen/txresult slot.
- isotpsendmsg(): waittxdone: drain skerr via sockerror() once we have read the result from so->txresult[], so an already-reported error doesn't stay latched for a later poll()/SOERROR.
Also align the remaining lock-free so->tx.state/rx.state/cfecho accesses and use skb->hash as unique loopback echo frame indicator.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Upgrade the Linux kernel with the resolved fix for the isotp TX state transition vulnerability (follow-up to commit cf070fe33bfb, titled “can: isotp: fix timer drain order, wakeup handling and tx_gen ordering”). Apply the patch that includes fixes such as draining so->txfrtimer before handling stale callbacks, correcting wait_event_interruptible/wait_tx_done behavior on ISOTP_SHUTDOWN, and aligning lock-free accesses to so->tx.state/so->rx.state/cfecho under the appropriate ordering/locking. (Patch/commit identifiers explicitly mentioned: cf070fe33bfb and cf070fe33bfb follow-up described in the material.)
Event History
Frequently Asked Questions
Which workloads are most relevant to this issue?
Systems using Linux CAN ISO-TP sockets are the relevant scope. The corrected paths involve concurrent send and socket-release activity, timer callbacks, and callers using CAN_ISOTP_WAIT_TX_DONE.
What race conditions does the fix address?
It prevents stale timer callbacks from re-arming the echo timer after a transmit claim, ensures blocked send operations wake when shutdown is forced, and avoids changing the timers or state of a newly claimed transfer. Transmit completion errors are associated with the caller's own transfer generation.
How can I determine whether the fix is present?
Check the source or package changelog for the applicable stable commit references: 8acab9fc66d6f426c36968c91a979f70784945a7, af7e25c649ed68cbad07f8185af0f31b892cbf29, or 2753722612d8824d3910096f93059f669009b0f0. The provided data does not identify affected or fixed kernel version numbers.