{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.105-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.8-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.107-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  can: isotp: fix timer drain order, wakeup handling and tx_gen ordering  This patch is a follow-up to commit cf070fe33bfb (\"can: isotp: serialize TX state transitions under so-\u003erx_lock\") which addresses following sashiko-bot findings:  - isotp_sendmsg(): drain so-\u003etxfrtimer first so a stale callback can't   re-arm echotimer after the claim  - isotp_release(): wake so-\u003ewait after forcing ISOTP_SHUTDOWN so a   sleeping sendmsg() claim isn't stranded  - isotp_sendmsg(): have both wait_event_interruptible() calls in   isotp_sendmsg() also wake on ISOTP_SHUTDOWN and do not return claim to   IDLE to avoid corrupting a concurrent isotp_release() process.  - isotp_sendmsg(): handle potential claim of a new transfer when   the wait_event_interruptible() call returns in CAN_ISOTP_WAIT_TX_DONE   mode. Don't touch timers and states of the new transfer if a new thread   incremented so-\u003etx_gen before getting the lock at err_event_drop.  - isotp_sendmsg(): handle a stuck can_send() and omit timer and state   changes if a new transfer was claimed. wait_tx_done() returns the error   recorded in so-\u003etx_result[], tagged with the caller's own generation.  - isotp_tx_timeout(): on a claimed timeout, record the ECOMM error for   the timed-out transfer's own generation in so-\u003etx_result[]; sk-\u003esk_err   is raised unconditionally, same as every other error path here.  - isotp_tx_gen_done()/isotp_tx_timeout(): always read tx.state (acquire)   before tx_gen - the reverse order let a weakly ordered CPU pair a fresh   tx.state with a stale tx_gen/tx_result slot.  - isotp_sendmsg(): wait_tx_done: drain sk_err via sock_error() once we   have read the result from so-\u003etx_result[], so an already-reported error   doesn't stay latched for a later poll()/SO_ERROR.  Also align the remaining lock-free so-\u003etx.state/rx.state/cfecho accesses and use skb-\u003ehash as unique loopback echo frame indicator.",
  "id": "DEBIAN-CVE-2026-80889",
  "modified": "2026-09-19T21:47:29.896379588Z",
  "published": "2026-09-04T18:17:56.910Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-80889"
    }
  ],
  "upstream": [
    "CVE-2026-80889"
  ]
}