CVE-2020-36789 is a vulnerability in the Linux kernel's Controller Area Network (CAN) subsystem related to improper handling of socket buffers (skbs) during hardware interrupt (IRQ) context. Specifically, the issue arises when the function can_get_echo_skb() is called in a hard IRQ context, which can trigger a WARN_ON(in_irq) warning in skb_release_head_state() under network congestion. The root cause is the inappropriate use of kfree_skb() to free skbs in an IRQ context instead of the IRQ-safe dev_kfree_skb_irq() function. This can lead to a NULL pointer dereference and potential kernel instability or crashes. The vulnerability stems from the fact that the CAN network stack is an exception to the original design assumption that loopback skbs are not received in hardware IRQ context. The patch to fix this issue involves incrementing the skb reference count with skb_get() to prevent premature freeing within netif_rx(), and deferring skb freeing to IRQ-safe functions dev_consume_skb_any() or dev_kfree_skb_any(). This fix is localized to the CAN network stack, as it is believed only CAN devices are affected. The vulnerability was initially reported in 2017 but was not accepted until now. There are no known exploits in the wild, and no CVSS score has been assigned yet.

For European organizations, this vulnerability primarily affects systems running Linux kernels with CAN network stack support, which is common in embedded systems, automotive, industrial control systems, and IoT devices. Exploitation could cause kernel warnings, NULL pointer dereferences, and potential system crashes or reboots, leading to denial of service (DoS). In critical infrastructure sectors such as automotive manufacturing, industrial automation, and transportation, where CAN bus is widely used, this could disrupt operations and safety systems. While it does not directly lead to privilege escalation or data leakage, the resulting instability can impact availability and reliability of critical systems. Organizations relying on Linux-based embedded devices or industrial controllers with CAN interfaces are at higher risk. The lack of known exploits reduces immediate threat but patching is important to prevent future exploitation, especially in congested network environments where the bug manifests.

1. Apply the official Linux kernel patches that address CVE-2020-36789 as soon as they are available from trusted Linux distributions or kernel maintainers. 2. For embedded and industrial systems, coordinate with device vendors to ensure updated firmware or kernel versions are deployed. 3. Monitor kernel logs for WARN_ON(in_irq) messages related to skb_release_head_state() as an indicator of potential triggering of this issue. 4. Limit network congestion on CAN interfaces where possible to reduce the chance of triggering the bug. 5. Implement robust system monitoring and automated recovery mechanisms to handle unexpected kernel crashes or reboots. 6. For systems where patching is delayed, consider isolating CAN-enabled devices from critical networks to reduce impact. 7. Engage with Linux kernel maintainers or security teams for guidance on backporting patches to older kernel versions if necessary.