This vulnerability resides in the Linux kernel’s CAN ISO-TP (streaming over transport protocol) implementation. It is caused by race conditions affecting timer drain order, wakeup handling, and transmission state generation. The flaw can allow an attacker to trigger corrupted transmission state, lost or stale callbacks, or stuck transmissions, potentially leading to a denial of service or compromised data integrity. The weakness is rooted in improper synchronization between concurrent send and release operations, consistent with a race condition fault.

All Linux kernel releases that contain the unpatched ISO-TP code, which includes all mainstream distributions prior to the inclusion of the fix commits cited in the description. The exact affected kernel versions are not listed, so any release lacking the committer’s patch should be considered vulnerable.

The CVSS score is not provided and the EPSS score is unavailable, but the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Because the bug occurs in kernel-level transmission handling, exploitation requires a user with access to CAN sockets or an attacker who can inject malformed CAN frames. The risk is therefore local and potentially escalatable to higher privileges if an attacker can manipulate kernel state. While no public exploits are noted, the nature of the race condition means that an unstable transmission loop could crash the networking stack or stall communication, constituting a denial of service. The absence of an EPSS score does not diminish that a determined local attacker could achieve the effect.