CVE-2026-80889: Linux Kernel CAN ISOTP Timer Vulnerability

CVE-2026-80889 Overview

CVE-2026-80889 is a race condition in the Linux kernel's Controller Area Network ISO-TP (can-isotp) implementation. The flaw stems from incorrect timer drain ordering, missing wakeups on shutdown, and improper handling of the tx_gen transfer generation counter during concurrent sendmsg() and release() operations. A stale txfrtimer callback can re-arm the echo timer after socket state transitions, and sleeping sendmsg() callers may be stranded when a concurrent isotp_release() forces ISOTP_SHUTDOWN. The patch series is a follow-up to commit cf070fe33bfb ("can: isotp: serialize TX state transitions under so->rx_lock").

Critical Impact
Concurrent socket operations on AF_CAN ISO-TP sockets can corrupt transfer state, leak errors between transfers, or leave threads blocked indefinitely.

Affected Products

Linux kernel can-isotp protocol implementation (net/can/isotp.c)
Distributions shipping affected stable kernel branches referenced in the upstream fix commits
Systems using CAN bus with ISO-TP sockets (CAN_ISOTP), common in automotive and industrial control environments

Discovery Timeline

2026-09-04 - CVE-2026-80889 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80889

Vulnerability Analysis

The vulnerability is a race condition [CWE-362] in the CAN ISO-TP socket layer affecting several ordering guarantees between isotp_sendmsg(), isotp_release(), isotp_tx_timeout(), and isotp_tx_gen_done(). Multiple sashiko-bot findings identified windows where a stale txfrtimer callback could re-arm echotimer after a socket claimed a new transfer. A sleeping sendmsg() waiter was not woken when isotp_release() set ISOTP_SHUTDOWN, leaving the caller stranded.

On weakly ordered CPUs, isotp_tx_gen_done() and isotp_tx_timeout() read tx_gen before tx.state. That reverse ordering could pair a fresh tx.state with a stale tx_gen slot in so->tx_result[]. A previously reported sk_err also remained latched for later poll() or SO_ERROR calls because the socket did not drain sk_err via sock_error() after reading the tagged result.

Root Cause

The root cause is missing serialization between socket teardown, timer cleanup, and transfer generation tracking. isotp_sendmsg() did not drain so->txfrtimer before claiming the socket, and wait_event_interruptible() calls did not include ISOTP_SHUTDOWN in their wakeup conditions. State transitions and generation counters were also updated in an order that permitted mismatched pairings under memory reordering.

Attack Vector

Exploitation requires local access to open an AF_CAN ISO-TP socket and issue concurrent sendmsg() and close() calls, or trigger transfer timeouts while another thread claims a new transfer. A local unprivileged user with permission to open CAN sockets can induce state corruption, spurious errors delivered to unrelated transfers, or hung threads. See the upstream fix commit deca774 and related backports for the full patch series.

No public proof-of-concept code is available. The upstream commits describe the vulnerable orderings in the code paths listed above.

Detection Methods for CVE-2026-80889

Indicators of Compromise

Unexpected ECOMM errors surfaced via SO_ERROR or poll() on CAN ISO-TP sockets
Processes stuck in wait_event_interruptible() inside isotp_sendmsg() after a peer socket closes
Kernel logs referencing unexpected echotimer or txfrtimer firings on can-isotp sockets

Detection Strategies

Audit installed kernel versions against the fix commits listed under Patch Information and flag hosts running unpatched stable branches
Monitor for local processes opening AF_CAN sockets with protocol CAN_ISOTP that were not part of an approved application inventory
Enable syzkaller-style fuzzing or kernel lock debugging (CONFIG_PROVE_LOCKING, CONFIG_DEBUG_ATOMIC_SLEEP) on test systems to surface ordering regressions

Monitoring Recommendations

Collect kernel version telemetry from Linux endpoints and compare against a patched baseline
Alert on repeated segfaults, hangs, or ECOMM errors in CAN-facing services on automotive gateways and industrial controllers
Track can module load events and unexpected use of the isotp protocol on hosts that should not require it

How to Mitigate CVE-2026-80889

Immediate Actions Required

Update to a Linux kernel build that includes the fix commits referenced by the upstream advisory
Restrict which users and containers can open AF_CAN sockets, particularly on systems exposing CAN interfaces
Blacklist the can_isotp kernel module on hosts that do not require ISO-TP functionality

Patch Information

Apply the upstream stable kernel patches referenced in the advisory: 050f010, 10be509, 2753722, 35c62ac, 8acab9f, af7e25c, bf5c4a8, and deca774. Consume vendor-provided kernel updates from your distribution once available.

Workarounds

Disable and blacklist the can_isotp kernel module where the protocol is not required
Constrain container and namespace capabilities so unprivileged workloads cannot create AF_CAN sockets
Restrict access to CAN interfaces at the udev and permissions layer to trusted service accounts only

bash

# Blacklist the can_isotp module on systems that do not use ISO-TP
echo 'blacklist can_isotp' | sudo tee /etc/modprobe.d/blacklist-can-isotp.conf
sudo rmmod can_isotp 2>/dev/null || true

# Verify the module is not loaded
lsmod | grep -E '^can_isotp' && echo 'STILL LOADED' || echo 'not loaded'