CVE-2026-74456can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error In peak_usb_start(), each RX URB transfer buffer is allocated with kmalloc() and the URB is flagged URB_FREE_BUFFER so that the final usb_free_urb() also frees the transfer buffer. If usb_submit_urb() fails, the error path frees the buffer explicitly with kfree(buf) and then calls usb_free_urb(urb). Because URB_FREE_BUFFER is set, usb_free_urb() -> urb_destroy() frees the same buffer a second time, a double free of the transfer buffer. BUG: KASAN: double-free in usb_free_urb.part.0+0x91/0xb0 Free of addr ffff8881069ccb80 by task trigger.sh/285 Call Trace: kfree+0x113/0x3c0 usb_free_urb.part.0+0x91/0xb0 Drop the redundant kfree(buf); usb_free_urb() already releases the transfer buffer. This mirrors commit 03819abbeb11 ("net: usb: lan78xx: Fix double free issue with interrupt buffer allocation").
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d before 914c3b8fa175acf8476ad31cf04e308638e3578e; from bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d before 5f2fa5840c34d3a558c57855781be75e03bef752; from bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d before b9088d581fff971a7eb1628f8dcc30df6cfef4dc; from bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d before 525640b93d3e5f82f4ebea4730f4e0cf799522ba; from bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d before 4bb3325075138dd5346b71589a959878b564dc0b; from bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d before 92d0de80ca2223b9c7da78020155b6cb27824cc0; from bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d before dfb17bf04a764462000f11258a7c06aa92d1f261; from bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d before 9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9 | CNA record |
References
- https://git.kernel.org/stable/c/914c3b8fa175acf8476ad31cf04e308638e3578e
- https://git.kernel.org/stable/c/5f2fa5840c34d3a558c57855781be75e03bef752
- https://git.kernel.org/stable/c/b9088d581fff971a7eb1628f8dcc30df6cfef4dc
- https://git.kernel.org/stable/c/525640b93d3e5f82f4ebea4730f4e0cf799522ba
- https://git.kernel.org/stable/c/4bb3325075138dd5346b71589a959878b564dc0b
- https://git.kernel.org/stable/c/92d0de80ca2223b9c7da78020155b6cb27824cc0
- https://git.kernel.org/stable/c/dfb17bf04a764462000f11258a7c06aa92d1f261
- https://git.kernel.org/stable/c/9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.