CVE-2026-74456

Summary (CVE-2026-74456): In the Linux kernel, the peak_usb path has a double-free in peak_usb_start() when URB_SUBMIT fails. Each RX URB transfer buffer is allocated with kmalloc() and flagged URB_FREE_BUFFER so that usb_free_urb() frees the transfer buffer. If usb_submit_urb() fails, the error ...

CVE-2026-74456 can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: peakusbstart: fix double free of transfer buffer on URB submit error In peakusbstart, each RX URB transfer buffer is allocated with kmalloc and the URB is flagged URBFREEBUFFER so that the final usbfreeurb also free...

EUVD-2026-59649

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: peakusbstart: fix double free of transfer buffer on URB submit error In peakusbstart, each RX URB transfer buffer is allocated with kmalloc and the URB is flagged URBFREEBUFFER so that the final usbfreeurb also free...

CVE-2026-74455 can: peak_usb: validate uCAN receive record lengths

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: validate uCAN receive record lengths pcanusbfddecodebuf walks uCAN records packed in one USB receive buffer. Require each record to contain the fixed header for its type, and verify CAN payload bytes before copying...

CVE-2026-74456 can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: peakusbstart: fix double free of transfer buffer on URB submit error In peakusbstart, each RX URB transfer buffer is allocated with kmalloc and the URB is flagged URBFREEBUFFER so that the final usbfreeurb also free...

CVE-2026-74455

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: validate uCAN receive record lengths pcanusbfddecodebuf walks uCAN records packed in one USB receive buffer. Require each record to contain the fixed header for its type, and verify CAN payload bytes before copying...

Linux Distros Unpatched Vulnerability : CVE-2026-74455

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: peakusb: validate uCAN receive record lengths pcanusbfddecodebuf walks uCAN records packed in one USB receive buffer. Require each record to contain the...

PT-2026-72908

In the Linux kernel, the following vulnerability has been resolved: can: peak usb: peak usb start: fix double free of transfer buffer on URB submit error In peak usb start, each RX URB transfer buffer is allocated with kmalloc and the URB is flagged URB FREE BUFFER so that the final usb free urb...

Linux Distros Unpatched Vulnerability : CVE-2026-74456

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: peakusb: peakusbstart: fix double free of transfer buffer on URB submit error In peakusbstart, each RX URB transfer buffer is allocated with kmalloc and t...

Linux Distros Unpatched Vulnerability : CVE-2026-74457

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: peakusb: add bounds check for USB channel index The channel control index ctrlidx is derived from rx-len which comes directly from a device USB payload. Th...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003831)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003831 advisory. In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peakusb/pcanusbfd.c driver, aka...

MiracleLinux 8 : kernel-4.18.0-553.69.1.el8_10 (AXSA:2025-10764:56)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10764:56 advisory. kernel: padata: fix UAF in padatareorder CVE-2025-21727 kernel: ipv6: mcast: extend RCU protection in igmp6send CVE-2025-21759 kernel: can: peakusb...

can: peak_usb: fix shift-out-of-bounds issue

...

AZL-68808 CVE-2025-40020 affecting package kernel for versions less than 6.6.112.1-2

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: fix shift-out-of-bounds issue Explicitly uses a 64-bit constant when the number of bits used for its shifting is 32 which is the case for PC CAN FD interfaces supported by this driver. mkl: update subject, apply...

EUVD-2025-35839

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: fix shift-out-of-bounds issue Explicitly uses a 64-bit constant when the number of bits used for its shifting is 32 which is the case for PC CAN FD interfaces supported by this driver. mkl: update subject, apply...

EUVD-2019-9153

Malware in sbrugna...

kernel: can: peak_usb: fix use after free bugs

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: fix use after free bugs After calling peakusbnetifrxniskb, dereferencing skb is unsafe. Especially, the canframe cf which aliases skb memory is accessed after the peakusbnetifrxni. Reordering the lines solves the...

CVE-2021-47670

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: fix use after free bugs After calling peakusbnetifrxniskb, dereferencing skb is unsafe. Especially, the canframe cf which aliases skb memory is accessed after the peakusbnetifrxni. Reordering the lines solves the...

CVE-2021-47670

CVE-2021-47670 (can: peak_usb) is a use-after-free in the Linux kernel can subsystem. After peak_usb_netif_rx_ni(skb) is called, the skb may be dereferenced, and the can_frame cf that aliases skb memory can access memory that has been freed. The issue is resolved by reordering code lines to preve...

CVE-2021-47670 can: peak_usb: fix use after free bugs

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: fix use after free bugs After calling peakusbnetifrxniskb, dereferencing skb is unsafe. Especially, the canframe cf which aliases skb memory is accessed after the peakusbnetifrxni. Reordering the lines solves the...