CVE-2026-74473 vxlan: use pskb_network_may_pull() in route_shortcircuit()

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull in routeshortcircuit routeshortcircuit currently calls pskbmaypullskb, sizeofstruct iphdr or ipv6hdr, which checks if bytes are available starting from skb-data. However, in vxlanxmit, skb-data point...

CVE-2026-74473

CVE-2026-74473 affects the Linux kernel’s VXLAN path. The issue arises in route_shortcircuit() which originally used pskb_may_pull() to ensure a network header length, but skb->data points to the MAC header in vxlan_xmit(), making the check insufficient and risking reading beyond the pulled bu...

EUVD-2026-59666

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull in routeshortcircuit routeshortcircuit currently calls pskbmaypullskb, sizeofstruct iphdr or ipv6hdr, which checks if bytes are available starting from skb-data. However, in vxlanxmit, skb-data point...

CVE-2026-74469 sctp: prevent peer transport count overflow

In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctpassocaddpeer increments the association's 16-bit transportcount for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sockdiag uses transportcount t...

CVE-2026-74469

The CVE-2026-74469 issue affects the Linux kernel SCTP implementation. It occurs in sctp_assoc_add_peer(), where a 16-bit transport_count is incremented for each new unique peer; once the 65,536th transport is added, the counter wraps to zero. SCTP sock_diag uses transport_count to reserve the IN...

CVE-2026-74469 sctp: prevent peer transport count overflow

In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctpassocaddpeer increments the association's 16-bit transportcount for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sockdiag uses transportcount t...

CVE-2026-74460 can: ems_usb: validate CPC message lengths

In the Linux kernel, the following vulnerability has been resolved: can: emsusb: validate CPC message lengths emsusbreadbulkcallback walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the...

CVE-2026-74460 can: ems_usb: validate CPC message lengths

In the Linux kernel, the following vulnerability has been resolved: can: emsusb: validate CPC message lengths emsusbreadbulkcallback walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the...

EUVD-2026-59653

In the Linux kernel, the following vulnerability has been resolved: can: emsusb: validate CPC message lengths emsusbreadbulkcallback walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the...

CVE-2026-74460

The CVE-2026-74460 issue affects the Linux kernel’s ems_usb path for CPC messages. The vulnerability arises in can: ems_usb: validate CPC message lengths, where ems_usb_read_bulk_callback() processes CPC messages in a USB receive buffer. The fix enforces that each declared CPC message fits within...

CVE-2026-74460

In the Linux kernel, the following vulnerability has been resolved: can: emsusb: validate CPC message lengths emsusbreadbulkcallback walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the...

CVE-2026-74458

Summary: CVE-2026-74458 affects the Linux kernel can: kvaser_usb_leaf code. The flaw allowed dispatch of variable-length USB commands when a nonzero command shorter than CMD_HEADER_LEN was received; a matching command could be copied into a caller-owned kvaser_cmd using the device-provided length...

EUVD-2026-59651

In the Linux kernel, the following vulnerability has been resolved: can: kvaserusbleaf: kvaserusbleafwaitcmd: validate received command extents The wait and bulk receive paths walk variable-length commands from a USB buffer. A nonzero command shorter than CMDHEADERLEN can still be dispatched, and...

CVE-2026-74459

CVE-2026-74459 (Linux kernel) affects the can: etas_es58x driver, specifically es58x_read_bulk_callback(). When RX URB resubmission fails (usb_submit_urb()), the callback currently does not release the allocated coherent transfer buffer, causing a buffer leak. The fixes documented in multiple sou...

CVE-2026-74459 can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure

In the Linux kernel, the following vulnerability has been resolved: can: etases58x: es58xreadbulkcallback: fix RX buffer leak on URB resubmit failure es58xreadbulkcallback resubmits the RX URB after processing a received packet. If the resubmit succeeds, the URB remains anchored and will be handl...

CVE-2026-74457

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: add bounds check for USB channel index The channel control index ctrlidx is derived from rx-len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usbif-dev is on...

CVE-2026-74455

The CVE-2026-74455 vulnerability in the Linux kernel concerns the peak_usb driver for CAN (uCAN) payloads. pcan_usb_fd_decode_buf() parses multiple CAN records packed in a single USB receive buffer and now requires each record to include the fixed header for its type and validates the CAN payload...

CVE-2026-74455 can: peak_usb: validate uCAN receive record lengths

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: validate uCAN receive record lengths pcanusbfddecodebuf walks uCAN records packed in one USB receive buffer. Require each record to contain the fixed header for its type, and verify CAN payload bytes before copying...

EUVD-2026-59648

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: validate uCAN receive record lengths pcanusbfddecodebuf walks uCAN records packed in one USB receive buffer. Require each record to contain the fixed header for its type, and verify CAN payload bytes before copying...

CVE-2026-74456

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: peakusbstart: fix double free of transfer buffer on URB submit error In peakusbstart, each RX URB transfer buffer is allocated with kmalloc and the URB is flagged URBFREEBUFFER so that the final usbfreeurb also free...