CVE-2026-74460 can: ems_usb: validate CPC message lengths

In the Linux kernel, the following vulnerability has been resolved: can: emsusb: validate CPC message lengths emsusbreadbulkcallback walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the...

EUVD-2026-59653

In the Linux kernel, the following vulnerability has been resolved: can: emsusb: validate CPC message lengths emsusbreadbulkcallback walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the...

CVE-2026-74460

The CVE-2026-74460 issue affects the Linux kernel’s ems_usb path for CPC messages. The vulnerability arises in can: ems_usb: validate CPC message lengths, where ems_usb_read_bulk_callback() processes CPC messages in a USB receive buffer. The fix enforces that each declared CPC message fits within...

CVE-2026-74460

In the Linux kernel, the following vulnerability has been resolved: can: emsusb: validate CPC message lengths emsusbreadbulkcallback walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the...

CVE-2026-74459

CVE-2026-74459 (Linux kernel) affects the can: etas_es58x driver, specifically es58x_read_bulk_callback(). When RX URB resubmission fails (usb_submit_urb()), the callback currently does not release the allocated coherent transfer buffer, causing a buffer leak. The fixes documented in multiple sou...

CVE-2026-74458

Summary: CVE-2026-74458 affects the Linux kernel can: kvaser_usb_leaf code. The flaw allowed dispatch of variable-length USB commands when a nonzero command shorter than CMD_HEADER_LEN was received; a matching command could be copied into a caller-owned kvaser_cmd using the device-provided length...

EUVD-2026-59651

In the Linux kernel, the following vulnerability has been resolved: can: kvaserusbleaf: kvaserusbleafwaitcmd: validate received command extents The wait and bulk receive paths walk variable-length commands from a USB buffer. A nonzero command shorter than CMDHEADERLEN can still be dispatched, and...

CVE-2026-74459 can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure

In the Linux kernel, the following vulnerability has been resolved: can: etases58x: es58xreadbulkcallback: fix RX buffer leak on URB resubmit failure es58xreadbulkcallback resubmits the RX URB after processing a received packet. If the resubmit succeeds, the URB remains anchored and will be handl...

CVE-2026-74457

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: add bounds check for USB channel index The channel control index ctrlidx is derived from rx-len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usbif-dev is on...

CVE-2026-74455

The CVE-2026-74455 vulnerability in the Linux kernel concerns the peak_usb driver for CAN (uCAN) payloads. pcan_usb_fd_decode_buf() parses multiple CAN records packed in a single USB receive buffer and now requires each record to include the fixed header for its type and validates the CAN payload...

CVE-2026-74455 can: peak_usb: validate uCAN receive record lengths

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: validate uCAN receive record lengths pcanusbfddecodebuf walks uCAN records packed in one USB receive buffer. Require each record to contain the fixed header for its type, and verify CAN payload bytes before copying...

EUVD-2026-59648

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: validate uCAN receive record lengths pcanusbfddecodebuf walks uCAN records packed in one USB receive buffer. Require each record to contain the fixed header for its type, and verify CAN payload bytes before copying...

CVE-2026-74456

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: peakusbstart: fix double free of transfer buffer on URB submit error In peakusbstart, each RX URB transfer buffer is allocated with kmalloc and the URB is flagged URBFREEBUFFER so that the final usbfreeurb also free...

CVE-2026-74455 can: peak_usb: validate uCAN receive record lengths

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: validate uCAN receive record lengths pcanusbfddecodebuf walks uCAN records packed in one USB receive buffer. Require each record to contain the fixed header for its type, and verify CAN payload bytes before copying...

CVE-2026-74455

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: validate uCAN receive record lengths pcanusbfddecodebuf walks uCAN records packed in one USB receive buffer. Require each record to contain the fixed header for its type, and verify CAN payload bytes before copying...

CVE-2026-74454 drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size vc4overflowmemwork points BPOA at a 512KB slot inside the 16MB binner BO, but writes the size of the whole BO to BPOS. On every binner out-of-memory event...

CVE-2026-74452

The CVE-2026-74452 issue affects the Linux kernel DRM Panthor firmware loading. In panthor_fw_load_section_entry(), the copied data size is computed as hdr.data.end - hdr.data.start without validating against the allocated section_size, permitting a crafted firmware to set section->data.size l...

CVE-2026-74452 drm/panthor: reject firmware sections with oversized data

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthorfwloadsectionentry, the data size to copy is calculated without validating it against the allocated sectionsize: section-data.size = hdr.data.end - hdr.data.star...

CVE-2026-74453

CVE-2026-74453 (Linux kernel, drm/vc4) : The issue arises in the VC4 tile binning path where the Tile State Data Array (TSDA) for a job’s tile set is left in the binner’s slot between submissions. A 16 MB binner buffer is split into 512 KB slots; TSDA is at the start of each slot and is used by h...

EUVD-2026-59645

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthorfwloadsectionentry, the data size to copy is calculated without validating it against the allocated sectionsize: section-data.size = hdr.data.end - hdr.data.star...