Unknown

CVE-2026-80889 — can: isotp: fix timer drain order, wakeup handling and tx_gen ordering

In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix timer drain order, wakeup handling and tx_gen ordering This patch is a follow-up to commit cf070fe33bfb ("can: isotp: serialize TX state transitions under so->rx_lock") which addresses following sashiko-bot findings: - isotp_sendmsg(): drain so->txfrtimer first so a stale callback can't re-arm echotimer after the claim - isotp_release(): wake so->wait after forcing ISOTP_SHUTDOWN so a sleeping sendmsg() claim isn't stranded - isotp_sendmsg(): have both wait_event_interruptible() calls in isotp_sendmsg() also wake on ISOTP_SHUTDOWN and do not return claim to IDLE to avoid corrupting a concurrent isotp_release() process. - isotp_sendmsg(): handle potential claim of a new transfer when the wait_event_interruptible() call returns in CAN_ISOTP_WAIT_TX_DONE mode. Don't touch timers and states of the new transfer if a new thread incremented so->tx_gen before getting the lock at err_event_drop. - isotp_sendmsg(): handle a stuck can_send() and omit timer and state changes if a new transfer was claimed. wait_tx_done() returns the error recorded in so->tx_result[], tagged with the caller's own generation. - isotp_tx_timeout(): on a claimed timeout, record the ECOMM error for the timed-out transfer's own generation in so->tx_result[]; sk->sk_err is raised unconditionally, same as every other error path here. - isotp_tx_gen_done()/isotp_tx_timeout(): always read tx.state (acquire) before tx_gen - the reverse order let a weakly ordered CPU pair a fresh tx.state with a stale tx_gen/tx_result slot. - isotp_sendmsg(): wait_tx_done: drain sk_err via sock_error() once we have read the result from so->tx_result[], so an already-reported error doesn't stay latched for a later poll()/SO_ERROR. Also align the remaining lock-free so->tx.state/rx.state/cfecho accesses and use skb->hash as unique loopback echo frame indicator.

Published Sep 4, 2026 · Updated Oct 15, 2026 · Sources: NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP · CNA: Linux

Low

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

No exploitation signal in the sources consulted so far.

How the score was calculated

EPSS 0.2% (30-day exploitation probability)+1

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation

Not confirmed

Not in CISA KEV — an absence of record, not proof it is unexploited.

EPSS FIRST

0.18%

ahead of 7% of scored CVEs · Oct 27, 2026

Affects

Linux

CVSS base

—

Score not published yet.

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

Identify exposed assets running the affected vendor/product/version combinations (Linux Linux).
No fix documented in the sources: reduce exposure and monitor the vendor advisory.
Search available logs for exploit probes, errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

Vendor	Product	Versions	Status	Source
Linux	Linux	≥ bbedeb67a9a684f2fb78c55bd3662c400526715e and < 8acab9fc66d6f426c36968c91a979f70784945a7≥ 377a8f500704da42ed86a4541ed930e9dcfdb2ea and < af7e25c649ed68cbad07f8185af0f31b892cbf29≥ 6da8119e8dd542194103139812d1a4b7dcd1aedd and < 2753722612d8824d3910096f93059f669009b0f0≥ 0b05eca9589f609e2491b528dccf683168a4cda8 and < bf5c4a8b24acb12739ebb9aea5510b007e4f5239≥ a7d90e7b5e75d7406c889fe36e9a61ee364a00cb and < deca7746b57d982cd4f0301f4443f56780c4a048≥ 37beb16e08cae94cc05840c7274225e3b0b38ae7 and < 10be509fa8fd95d1e47d40d1f68b0b26dfe9d572≥ 4f1fdf1a1c317bcac0c6b6c8e12642c9983de1ca and < 35c62ac98d06669aa3f0f38b7829eaca929a611e≥ cf070fe33bfbd1a4c21236078fadb35dd223a157 and < 050f010f920da17c1044a4f174766ad553e770b6 and 7 more ≥ 5.10.265 and < 5.10.267≥ 5.15.216 and < 5.15.218≥ 6.1.183 and < 6.1.185≥ 6.6.148 and < 6.6.151≥ 6.12.101 and < 6.12.103≥ 6.18.40 and < 6.18.44≥ 7.1.5 and < 7.1.8	Vulnerable	CVE Program (cve.org) e CISA ADP

EPSS over time FIRST

Oct 15, 2026 → Oct 27, 2026 · 12 reading(s) · max 0.18%

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

Not enough vector or weakness data: use the affected application’s logs as a starting point.

application logs

Timeline

What happened to this CVE, newest first.

2026
Record published
Oct 15, 2026
Affected products added · linux/linux
Oct 15, 2026 · CVE Program (cve.org) e CISA ADP
Source status changed · → Received
Oct 15, 2026 · NIST National Vulnerability Database
Record created in this database
Oct 15, 2026 · NIST National Vulnerability Database
CVE published
Sep 4, 2026 · Linux

Source activity

Repeated readings are counted rather than listed.

1× Official description updated · Oct 15, 2026 – Oct 15, 2026

References

8 on the record

git.kernel.org/stable/c/050f010f920da17c1044a4f174766ad553e770b6
NIST National Vulnerability Database
git.kernel.org/stable/c/af7e25c649ed68cbad07f8185af0f31b892cbf29
NIST National Vulnerability Database
git.kernel.org/stable/c/8acab9fc66d6f426c36968c91a979f70784945a7
NIST National Vulnerability Database
git.kernel.org/stable/c/10be509fa8fd95d1e47d40d1f68b0b26dfe9d572
NIST National Vulnerability Database
git.kernel.org/stable/c/35c62ac98d06669aa3f0f38b7829eaca929a611e
NIST National Vulnerability Database
git.kernel.org/stable/c/deca7746b57d982cd4f0301f4443f56780c4a048
NIST National Vulnerability Database
git.kernel.org/stable/c/2753722612d8824d3910096f93059f669009b0f0
NIST National Vulnerability Database
git.kernel.org/stable/c/bf5c4a8b24acb12739ebb9aea5510b007e4f5239
NIST National Vulnerability Database

Elsewhere on this site

Linux
every CVE for this vendor

Related CVEs (same products)

Unknown CVE-2026-99215 power: supply: core: prevent unregistering a power supply while a callback runs 5h
Unknown CVE-2026-99216 Drivers: hv: Don't reset VMBus connection state on error/exit paths 5h
Unknown CVE-2026-99214 drm/vc4: hdmi: Move packet RAM enable to PM runtime 5h
Unknown CVE-2026-99213 vsock: treat TCP_CLOSING as once-established 5h
Unknown CVE-2026-99212 net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure 5h
Unknown CVE-2026-99211 netlink: reset skb headers before unicast and multicast filtering 5h

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No CVSS score published by NVD, the CNA, CISA or GitHub so far.
No fixed version, patch or mitigation documented.
No CISA SSVC assessment.
No CWE classification.
No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2026-80889 is "can: isotp: fix timer drain order, wakeup handling and tx_gen ordering", rated Unknown. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. EPSS 0.18% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.