The vulnerability occurs in the Linux kernel’s ISO‑TP (ISO 15765‑2) CAN transport stack. When a CAN device is unregistered, the socket’s bound flag is cleared without giving a grace period for in‑flight receive callbacks. Consequently, a subsequent socket release can cancel an active receive timer while the callback is still executing, causing a use‑after‑free of the socket structure and a timer callback to run on freed memory. This flaw involves improper synchronization (CWE‑367), a use‑after‑free of the socket structure, potentially resulting in a kernel crash or unstable behavior.

All Linux kernel releases that contain the ISO‑TP implementation, regardless of distribution. The flaw is tied to the generic Linux kernel and any system that enables ISO‑TP CAN filters. No vendor‑specific product version list is available, so the vulnerability exists across the kernel’s code base.

The CVSS score of 7.8 indicates relatively high severity. The EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the KEV catalog. The only available detail about how an attacker could trigger the race is that it requires interaction with the CAN network; based on that, the likely attack vector is local or man‑in‑the‑middle access to the CAN bus. This inference is made because the CVE description does not explicitly state the attack vector. The use‑after‑free could lead to a kernel panic; privileged elevation would depend on an attacker being able to influence the freed memory, which is not specified.