Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-80889— can: isotp: fix timer drain order, wakeup handling and tx_gen ordering

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 5.10.265至5.10.267之前版本、5.15.216至5.15.218之前版本、6.1.183至6.1.185之前版本、6.6.148至6.6.151之前版本、6.12.101至6.12.103之前版本、6.18.40至6.18.44之前版本和7.1.5至7.1.8之前版本存在安全漏洞，该漏洞源于can:isotp模块中定时器排空顺序、唤醒处理及tx_gen排序不当，可能导致并发状态下状态损坏、进程阻

AI Predicted 5.5 Difficulty: Hard EPSS 0.18% · P8

Affected Version Matrix 15

VendorProduct Version RangeStatus
Linux Linux bbedeb67a9a684f2fb78c55bd3662c400526715e< 8acab9fc66d6f426c36968c91a979f70784945a7 affected
377a8f500704da42ed86a4541ed930e9dcfdb2ea< af7e25c649ed68cbad07f8185af0f31b892cbf29 affected
6da8119e8dd542194103139812d1a4b7dcd1aedd< 2753722612d8824d3910096f93059f669009b0f0 affected
0b05eca9589f609e2491b528dccf683168a4cda8< bf5c4a8b24acb12739ebb9aea5510b007e4f5239 affected
a7d90e7b5e75d7406c889fe36e9a61ee364a00cb< deca7746b57d982cd4f0301f4443f56780c4a048 affected
37beb16e08cae94cc05840c7274225e3b0b38ae7< 10be509fa8fd95d1e47d40d1f68b0b26dfe9d572 affected
4f1fdf1a1c317bcac0c6b6c8e12642c9983de1ca< 35c62ac98d06669aa3f0f38b7829eaca929a611e affected
cf070fe33bfbd1a4c21236078fadb35dd223a157< 050f010f920da17c1044a4f174766ad553e770b6 affected
… +7 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80889

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix timer drain order, wakeup handling and tx_gen ordering This patch is a follow-up to commit cf070fe33bfb ("can: isotp: serialize TX state transitions under so->rx_lock") which addresses following sashiko-bot findings: - isotp_sendmsg(): drain so->txfrtimer first so a stale callback can't re-arm echotimer after the claim - isotp_release(): wake so->wait after forcing ISOTP_SHUTDOWN so a sleeping sendmsg() claim isn't stranded - isotp_sendmsg(): have both wait_event_interruptible() calls in isotp_sendmsg() also wake on ISOTP_SHUTDOWN and do not return claim to IDLE to avoid corrupting a concurrent isotp_release() process. - isotp_sendmsg(): handle potential claim of a new transfer when the wait_event_interruptible() call returns in CAN_ISOTP_WAIT_TX_DONE mode. Don't touch timers and states of the new transfer if a new thread incremented so->tx_gen before getting the lock at err_event_drop. - isotp_sendmsg(): handle a stuck can_send() and omit timer and state changes if a new transfer was claimed. wait_tx_done() returns the error recorded in so->tx_result[], tagged with the caller's own generation. - isotp_tx_timeout(): on a claimed timeout, record the ECOMM error for the timed-out transfer's own generation in so->tx_result[]; sk->sk_err is raised unconditionally, same as every other error path here. - isotp_tx_gen_done()/isotp_tx_timeout(): always read tx.state (acquire) before tx_gen - the reverse order let a weakly ordered CPU pair a fresh tx.state with a stale tx_gen/tx_result slot. - isotp_sendmsg(): wait_tx_done: drain sk_err via sock_error() once we have read the result from so->tx_result[], so an already-reported error doesn't stay latched for a later poll()/SO_ERROR. Also align the remaining lock-free so->tx.state/rx.state/cfecho accesses and use skb->hash as unique loopback echo frame indicator.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 5.10.265至5.10.267之前版本、5.15.216至5.15.218之前版本、6.1.183至6.1.185之前版本、6.6.148至6.6.151之前版本、6.12.101至6.12.103之前版本、6.18.40至6.18.44之前版本和7.1.5至7.1.8之前版本存在安全漏洞，该漏洞源于can:isotp模块中定时器排空顺序、唤醒处理及tx_gen排序不当，可能导致并发状态下状态损坏、进程阻
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux bbedeb67a9a684f2fb78c55bd3662c400526715e ~ 8acab9fc66d6f426c36968c91a979f70784945a7 -
Linux Linux 5.10.265 ~ 5.10.267 -

II. Public POCs for CVE-2026-80889

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80889

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80889 (7)

Same Patch Batch · Linux · 2026-09-04 · 156 CVEs total

CVE-2026-80864 RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
CVE-2026-80855 fuse: fix invalidate lock leak on open O_TRUNC DAX failure
CVE-2026-80856 fuse: fix invalidate lock leak on setattr writeback failure
CVE-2026-80857 fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free
CVE-2026-80858 fuse: publish io-uring queues with release semantics
CVE-2026-80859 fuse: fix missing barrier when checking io-uring readiness
CVE-2026-80860 fuse: fix race between interrupt and resend
CVE-2026-80861 usb: xhci: bail out of setup if the controller is inaccessible
CVE-2026-80862 nvme-tcp: fix usage of page_frag_cache
CVE-2026-80863 RDMA/rxe: Fix OOB in free_rd_atomic_resources()
CVE-2026-80869 ntfs: bound the attribute-list entry in ntfs_read_inode_mount()
CVE-2026-80873 KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions
CVE-2026-80872 ALSA: hda/tas2781: Cancel async firmware request at unbind
CVE-2026-80871 crypto: xilinx-trng - Remove crypto_rng interface
CVE-2026-80870 drm/amdkfd: Validate CRIU-restored IDs before idr_alloc
CVE-2026-80867 alpha/PCI: Add security_locked_down() check to pci_mmap_resource()
CVE-2026-80865 bpf: Add missing access_ok call to copy_user_syms
CVE-2026-80866 tipc: avoid busy looping in tipc_exit_net()
CVE-2026-80854 usb: gadget: f_tcm: keep port count until LUN teardown completes
CVE-2026-80868 ntfs3: Allocate iomap inline_data using alloc_page

Showing top 20 of 156 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-80889

No comments yet

Leave a comment