CVE-2026-64585can: esd_usb: kill anchored URBs before freeing netdevs
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: can: esd_usb: kill anchored URBs before freeing netdevs esd_usb_disconnect() frees each CAN netdev with free_candev() inside its per-netdev loop and only calls unlink_all_urbs(dev) afterwards. The per-netdev private data (struct esd_usb_net_priv) is embedded in the net_device allocation returned by alloc_candev(), so once free_candev() has run, dev->nets[i] points to freed memory. unlink_all_urbs() then dereferences the freed dev->nets[i] to kill the per-netdev TX anchor (usb_kill_anchored_urbs(&priv->tx_submitted)), clear active_tx_jobs, and reset priv->tx_contexts[]. Reorder the teardown so the anchored URBs are killed before the netdevs are freed, matching other CAN/USB drivers in the same directory such as ems_usb, usb_8dev and mcba_usb, which unregister, then unlink, then free: unregister the netdevs first (which stops their TX queues), call unlink_all_urbs(dev) once, then free the netdevs. This issue was found by an in-house static analysis tool.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 23, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 96d8e90382dc336b5de401164597edfdc2e8d9f1 before d12f6add48f2da15c8c8281961d3faad804c76cf; from 96d8e90382dc336b5de401164597edfdc2e8d9f1 before aa1d005927db38af783c1a4a8a00a39e0229ab2d; from 96d8e90382dc336b5de401164597edfdc2e8d9f1 before a02e1d8f191324583599544d54e59e6a2b74bb0e; from 96d8e90382dc336b5de401164597edfdc2e8d9f1 before a3314f10369df70925140f59bbe069718f65a0b9; from 96d8e90382dc336b5de401164597edfdc2e8d9f1 before 765ba1c91823a296447528791b89a6504947fd5c; from 96d8e90382dc336b5de401164597edfdc2e8d9f1 before 5832c55b3c824ba2fe9c36ac3c411baddcce053e; from 96d8e90382dc336b5de401164597edfdc2e8d9f1 before c43122fef328a70045fe7621c06de6b2b8e19264 | CNA record |
References
- https://git.kernel.org/stable/c/d12f6add48f2da15c8c8281961d3faad804c76cf
- https://git.kernel.org/stable/c/aa1d005927db38af783c1a4a8a00a39e0229ab2d
- https://git.kernel.org/stable/c/a02e1d8f191324583599544d54e59e6a2b74bb0e
- https://git.kernel.org/stable/c/a3314f10369df70925140f59bbe069718f65a0b9
- https://git.kernel.org/stable/c/765ba1c91823a296447528791b89a6504947fd5c
- https://git.kernel.org/stable/c/5832c55b3c824ba2fe9c36ac3c411baddcce053e
- https://git.kernel.org/stable/c/c43122fef328a70045fe7621c06de6b2b8e19264
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.