The Linux kernel’s CAN raw socket driver performs a read‑modify‑write on a shared bitfield when updating socket flags. Because this operation lacks proper locking, concurrent invocations of raw_setsockopt() can interleave and corrupt kernel state or produce inconsistent flag values. The weakness is a classic race condition tied to the use of bitfields for flag storage.

All Linux kernel releases prior to the commit that introduced locking for raw CAN socket flags are affected. The commit that implements the fix is 890e5198a6e5, which adds a wrapper and locking around raw_setsockopt() to serialize concurrent access.

The CVSS score of 7.8 indicates high severity. EPSS is <1%, and the vulnerability is not listed in CISA KEV. The race condition requires concurrent access to the raw CAN socket interface, typically available to users with the ability to open multiple sockets locally. No public exploitation data is available, and the risk is mainly limited to systems running unpatched kernels where privileged access is possible.