The flaw is a concurrent race in the Linux kernel’s CAN isotp socket implementation. When a network device is unregistered, the device is removed from the ifindex hash before the NETDEV_UNREGISTER notifier chain runs. If a concurrent isotp_release() occurs, it may fail to locate the device, skip CAN receive unregistration, and proceed to free the socket. Because the socket has already been removed from the isotp notifier list, a subsequent notifier chain does not clean up the stale CAN filter, leaving a dangling reference to a freed socket. This use‑after‑free can corrupt memory or leave a stale filter that misdirects CAN traffic, potentially causing unexpected behaviour or local denial of service.

All Linux kernel builds that do not contain the commit adding a tracked reference to the bound net_device in the socket and serializing bind/release with rtnl_lock(). The affected component is the isotp socket implementation within the Linux kernel; the only vendor listed is Linux.

The EPSS score of less than 1% indicates a very low likelihood of exploitation, yet the CVSS score of 7.8 classifies the flaw as high severity. The issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Because the race requires a concurrent release of an isotp socket and the unregistration of a network device, the attack vector is local and likely requires privileged or kernel context. An attacker with root or a capable application that can create isotp sockets and manage network interfaces could trigger the race to corrupt memory or disrupt CAN communication. The overall risk is high if the relevant interfaces are accessible to compromised users, but exploitation confidence remains low based on available data.