CVE-2026-74456 (GCVE-0-2026-74456)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:26 – Updated: 2026-10-16 19:05
VLAI
EPSS
VEX
Title
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
In peak_usb_start(), each RX URB transfer buffer is allocated with kmalloc()
and the URB is flagged URB_FREE_BUFFER so that the final usb_free_urb() also
frees the transfer buffer.
If usb_submit_urb() fails, the error path frees the buffer explicitly with
kfree(buf) and then calls usb_free_urb(urb). Because URB_FREE_BUFFER is set,
usb_free_urb() -> urb_destroy() frees the same buffer a second time, a double
free of the transfer buffer.
BUG: KASAN: double-free in usb_free_urb.part.0+0x91/0xb0
Free of addr ffff8881069ccb80 by task trigger.sh/285
Call Trace:
kfree+0x113/0x3c0
usb_free_urb.part.0+0x91/0xb0
Drop the redundant kfree(buf); usb_free_urb() already releases the transfer
buffer. This mirrors commit 03819abbeb11 ("net: usb: lan78xx: Fix double free
issue with interrupt buffer allocation").
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 18:56 UTC
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < 914c3b8fa175acf8476ad31cf04e308638e3578e
(git)
Affected: bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < 5f2fa5840c34d3a558c57855781be75e03bef752 (git) Affected: bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < b9088d581fff971a7eb1628f8dcc30df6cfef4dc (git) Affected: bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < 525640b93d3e5f82f4ebea4730f4e0cf799522ba (git) Affected: bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < 4bb3325075138dd5346b71589a959878b564dc0b (git) Affected: bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < 92d0de80ca2223b9c7da78020155b6cb27824cc0 (git) Affected: bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < dfb17bf04a764462000f11258a7c06aa92d1f261 (git) Affected: bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < 9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9 (git) |
guessed | |
| Linux | Linux |
Affected:
3.4
Unaffected: 0 , < 3.4 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74456",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:56:58.741801Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:46.867Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/peak_usb/pcan_usb_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "914c3b8fa175acf8476ad31cf04e308638e3578e",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "5f2fa5840c34d3a558c57855781be75e03bef752",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "b9088d581fff971a7eb1628f8dcc30df6cfef4dc",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "525640b93d3e5f82f4ebea4730f4e0cf799522ba",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "4bb3325075138dd5346b71589a959878b564dc0b",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "92d0de80ca2223b9c7da78020155b6cb27824cc0",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "dfb17bf04a764462000f11258a7c06aa92d1f261",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/peak_usb/pcan_usb_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.4"
},
{
"lessThan": "3.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error\n\nIn peak_usb_start(), each RX URB transfer buffer is allocated with kmalloc()\nand the URB is flagged URB_FREE_BUFFER so that the final usb_free_urb() also\nfrees the transfer buffer.\n\nIf usb_submit_urb() fails, the error path frees the buffer explicitly with\nkfree(buf) and then calls usb_free_urb(urb). Because URB_FREE_BUFFER is set,\nusb_free_urb() -\u003e urb_destroy() frees the same buffer a second time, a double\nfree of the transfer buffer.\n\n BUG: KASAN: double-free in usb_free_urb.part.0+0x91/0xb0\n Free of addr ffff8881069ccb80 by task trigger.sh/285\n\n Call Trace:\n kfree+0x113/0x3c0\n usb_free_urb.part.0+0x91/0xb0\n\nDrop the redundant kfree(buf); usb_free_urb() already releases the transfer\nbuffer. This mirrors commit 03819abbeb11 (\"net: usb: lan78xx: Fix double free\nissue with interrupt buffer allocation\")."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is only reached when a privileged local actor brings the PEAK CAN netdev up via rtnetlink/ioctl (peak_usb_ndo_open\u2192peak_usb_start); CAN-bus traffic and remote protocols never call this setup path, but the entry is a local syscall rather than USB packet processing.\nAC:L - Any usb_submit_urb() failure on RX setup deterministically hits the broken error path; an attacker can reliably force -ENODEV/-ENOENT by disconnecting/resetting the adapter or presenting a rogue PEAK-class gadget while repeatedly running ip link set canX up/down.\nPR:L - Bringing the CAN interface up requires CAP_NET_ADMIN on RTM_SETLINK (rtnl_setlink/netif_open), which is Low under CNA guidance; on automotive/industrial diagnostic hosts this is commonly held by technician/service accounts even though unauthenticated remote attackers cannot reach the path.\nUI:N - No separate victim interaction is needed beyond the attacker (or their malware) issuing the privileged link-up that enters peak_usb_start; they can also script repeated up/down cycles while manipulating USB state themselves.\nS:U - The double-free corrupts host kernel kmalloc slab state within the peak_usb driver scope and does not by itself cross a security boundary such as VM escape, container breakout, or IOMMU bypass.\nC:H - This is a kmalloc RX-buffer double-free with URB_FREE_BUFFER set; per CNA guidance such heap double-free/UAF-class bugs enable controlled reallocation and arbitrary kernel memory disclosure, not merely a bounded leak.\nI:H - Freeing the same 64\u20132048 byte RX slab object twice corrupts SLUB freelist/metadata and provides a standard heap corruption primitive that can be groomed into arbitrary kernel writes or control-flow hijacking.\nA:H - KASAN already reports a double-free in usb_free_urb() on this path; even without full exploitation, allocator corruption typically causes kernel BUG/oops/panic and repeated trigger cycles can deny CAN/USB service on shared diagnostic systems."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:36:51.237Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/914c3b8fa175acf8476ad31cf04e308638e3578e"
},
{
"url": "https://git.kernel.org/stable/c/5f2fa5840c34d3a558c57855781be75e03bef752"
},
{
"url": "https://git.kernel.org/stable/c/b9088d581fff971a7eb1628f8dcc30df6cfef4dc"
},
{
"url": "https://git.kernel.org/stable/c/525640b93d3e5f82f4ebea4730f4e0cf799522ba"
},
{
"url": "https://git.kernel.org/stable/c/4bb3325075138dd5346b71589a959878b564dc0b"
},
{
"url": "https://git.kernel.org/stable/c/92d0de80ca2223b9c7da78020155b6cb27824cc0"
},
{
"url": "https://git.kernel.org/stable/c/dfb17bf04a764462000f11258a7c06aa92d1f261"
},
{
"url": "https://git.kernel.org/stable/c/9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9"
}
],
"title": "can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74456",
"datePublished": "2026-08-15T12:26:58.808Z",
"dateReserved": "2026-08-15T05:44:03.900Z",
"dateUpdated": "2026-10-16T19:05:46.867Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-74456",
"date": "2026-11-01",
"epss": "0.00129",
"percentile": "0.0254"
},
"microsoft_vex": {
"current_release_date": "2026-09-25T02:24:55.000Z",
"cve": "CVE-2026-74456",
"id": "msrc_CVE-2026-74456",
"initial_release_date": "2026-08-23T14:59:00.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74456.json",
"version": "3"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/peak_usb/pcan_usb_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "914c3b8fa175acf8476ad31cf04e308638e3578e",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "5f2fa5840c34d3a558c57855781be75e03bef752",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "b9088d581fff971a7eb1628f8dcc30df6cfef4dc",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "525640b93d3e5f82f4ebea4730f4e0cf799522ba",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "4bb3325075138dd5346b71589a959878b564dc0b",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "92d0de80ca2223b9c7da78020155b6cb27824cc0",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "dfb17bf04a764462000f11258a7c06aa92d1f261",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/peak_usb/pcan_usb_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.4"
},
{
"lessThan": "3.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error\n\nIn peak_usb_start(), each RX URB transfer buffer is allocated with kmalloc()\nand the URB is flagged URB_FREE_BUFFER so that the final usb_free_urb() also\nfrees the transfer buffer.\n\nIf usb_submit_urb() fails, the error path frees the buffer explicitly with\nkfree(buf) and then calls usb_free_urb(urb). Because URB_FREE_BUFFER is set,\nusb_free_urb() -\u003e urb_destroy() frees the same buffer a second time, a double\nfree of the transfer buffer.\n\n BUG: KASAN: double-free in usb_free_urb.part.0+0x91/0xb0\n Free of addr ffff8881069ccb80 by task trigger.sh/285\n\n Call Trace:\n kfree+0x113/0x3c0\n usb_free_urb.part.0+0x91/0xb0\n\nDrop the redundant kfree(buf); usb_free_urb() already releases the transfer\nbuffer. This mirrors commit 03819abbeb11 (\"net: usb: lan78xx: Fix double free\nissue with interrupt buffer allocation\")."
}
],
"id": "CVE-2026-74456",
"lastModified": "2026-10-16T20:17:29.017",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-74456",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:56:58.741801Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-15T13:17:50.227",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/4bb3325075138dd5346b71589a959878b564dc0b"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/525640b93d3e5f82f4ebea4730f4e0cf799522ba"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/5f2fa5840c34d3a558c57855781be75e03bef752"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/914c3b8fa175acf8476ad31cf04e308638e3578e"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/92d0de80ca2223b9c7da78020155b6cb27824cc0"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/b9088d581fff971a7eb1628f8dcc30df6cfef4dc"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/dfb17bf04a764462000f11258a7c06aa92d1f261"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-10-27T05:16:58+00:00",
"cve": "CVE-2026-74456",
"id": "CVE-2026-74456",
"initial_release_date": "2026-08-15T00:00:00+00:00",
"product_status:known_affected": "262",
"product_status:known_not_affected": "14",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74456.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74456",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:56:58.741801Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:56:59.775Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/peak_usb/pcan_usb_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "914c3b8fa175acf8476ad31cf04e308638e3578e",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "5f2fa5840c34d3a558c57855781be75e03bef752",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "b9088d581fff971a7eb1628f8dcc30df6cfef4dc",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "525640b93d3e5f82f4ebea4730f4e0cf799522ba",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "4bb3325075138dd5346b71589a959878b564dc0b",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "92d0de80ca2223b9c7da78020155b6cb27824cc0",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "dfb17bf04a764462000f11258a7c06aa92d1f261",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
},
{
"lessThan": "9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9",
"status": "affected",
"version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/peak_usb/pcan_usb_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.4"
},
{
"lessThan": "3.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error\n\nIn peak_usb_start(), each RX URB transfer buffer is allocated with kmalloc()\nand the URB is flagged URB_FREE_BUFFER so that the final usb_free_urb() also\nfrees the transfer buffer.\n\nIf usb_submit_urb() fails, the error path frees the buffer explicitly with\nkfree(buf) and then calls usb_free_urb(urb). Because URB_FREE_BUFFER is set,\nusb_free_urb() -\u003e urb_destroy() frees the same buffer a second time, a double\nfree of the transfer buffer.\n\n BUG: KASAN: double-free in usb_free_urb.part.0+0x91/0xb0\n Free of addr ffff8881069ccb80 by task trigger.sh/285\n\n Call Trace:\n kfree+0x113/0x3c0\n usb_free_urb.part.0+0x91/0xb0\n\nDrop the redundant kfree(buf); usb_free_urb() already releases the transfer\nbuffer. This mirrors commit 03819abbeb11 (\"net: usb: lan78xx: Fix double free\nissue with interrupt buffer allocation\")."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is only reached when a privileged local actor brings the PEAK CAN netdev up via rtnetlink/ioctl (peak_usb_ndo_open\u2192peak_usb_start); CAN-bus traffic and remote protocols never call this setup path, but the entry is a local syscall rather than USB packet processing.\nAC:L - Any usb_submit_urb() failure on RX setup deterministically hits the broken error path; an attacker can reliably force -ENODEV/-ENOENT by disconnecting/resetting the adapter or presenting a rogue PEAK-class gadget while repeatedly running ip link set canX up/down.\nPR:L - Bringing the CAN interface up requires CAP_NET_ADMIN on RTM_SETLINK (rtnl_setlink/netif_open), which is Low under CNA guidance; on automotive/industrial diagnostic hosts this is commonly held by technician/service accounts even though unauthenticated remote attackers cannot reach the path.\nUI:N - No separate victim interaction is needed beyond the attacker (or their malware) issuing the privileged link-up that enters peak_usb_start; they can also script repeated up/down cycles while manipulating USB state themselves.\nS:U - The double-free corrupts host kernel kmalloc slab state within the peak_usb driver scope and does not by itself cross a security boundary such as VM escape, container breakout, or IOMMU bypass.\nC:H - This is a kmalloc RX-buffer double-free with URB_FREE_BUFFER set; per CNA guidance such heap double-free/UAF-class bugs enable controlled reallocation and arbitrary kernel memory disclosure, not merely a bounded leak.\nI:H - Freeing the same 64\u20132048 byte RX slab object twice corrupts SLUB freelist/metadata and provides a standard heap corruption primitive that can be groomed into arbitrary kernel writes or control-flow hijacking.\nA:H - KASAN already reports a double-free in usb_free_urb() on this path; even without full exploitation, allocator corruption typically causes kernel BUG/oops/panic and repeated trigger cycles can deny CAN/USB service on shared diagnostic systems."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:36:51.237Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/914c3b8fa175acf8476ad31cf04e308638e3578e"
},
{
"url": "https://git.kernel.org/stable/c/5f2fa5840c34d3a558c57855781be75e03bef752"
},
{
"url": "https://git.kernel.org/stable/c/b9088d581fff971a7eb1628f8dcc30df6cfef4dc"
},
{
"url": "https://git.kernel.org/stable/c/525640b93d3e5f82f4ebea4730f4e0cf799522ba"
},
{
"url": "https://git.kernel.org/stable/c/4bb3325075138dd5346b71589a959878b564dc0b"
},
{
"url": "https://git.kernel.org/stable/c/92d0de80ca2223b9c7da78020155b6cb27824cc0"
},
{
"url": "https://git.kernel.org/stable/c/dfb17bf04a764462000f11258a7c06aa92d1f261"
},
{
"url": "https://git.kernel.org/stable/c/9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9"
}
],
"title": "can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74456",
"datePublished": "2026-08-15T12:26:58.808Z",
"dateReserved": "2026-08-15T05:44:03.900Z",
"dateUpdated": "2026-10-16T19:05:46.867Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.