CVE-2026-74457can: peak_usb: add bounds check for USB channel index
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: add bounds check for USB channel index The channel control index ctrl_idx is derived from rx->len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usb_if->dev[] is only 2. Values 2-15 cause heap out-of-bounds read, eventually causing kernel panic in the IRQ context. Add bounds checking for ctrl_idx before the array access in both pcan_usb_pro_handle_canmsg() and pcan_usb_pro_handle_error().
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d8a199355f8f8a0797c00d98788d7282c9ea38bd before 18b1a868a2cda66fb438007ba47ce5f2484db381; from d8a199355f8f8a0797c00d98788d7282c9ea38bd before 0c9268457bd6e4058fe55b4db01b16661c2eacf5; from d8a199355f8f8a0797c00d98788d7282c9ea38bd before 94fb6fe83ce152532b11b36730b30f3dc0c94217; from d8a199355f8f8a0797c00d98788d7282c9ea38bd before 825c903ca3c98cd0cf0e3de8ab8f2604a5339b3f; from d8a199355f8f8a0797c00d98788d7282c9ea38bd before f97b7e5e1cdaae15cd95b3a360028c7929664969; from d8a199355f8f8a0797c00d98788d7282c9ea38bd before 1acab790b7cecd4e144d1d18bdfe549e282f6b0b; from d8a199355f8f8a0797c00d98788d7282c9ea38bd before 0149fdb50a30944827acf9600a2cc44de0325a7f; from d8a199355f8f8a0797c00d98788d7282c9ea38bd before 39132f166ca8ce00ae60d8a9068e06a60943cc4b | CNA record |
References
- https://git.kernel.org/stable/c/18b1a868a2cda66fb438007ba47ce5f2484db381
- https://git.kernel.org/stable/c/0c9268457bd6e4058fe55b4db01b16661c2eacf5
- https://git.kernel.org/stable/c/94fb6fe83ce152532b11b36730b30f3dc0c94217
- https://git.kernel.org/stable/c/825c903ca3c98cd0cf0e3de8ab8f2604a5339b3f
- https://git.kernel.org/stable/c/f97b7e5e1cdaae15cd95b3a360028c7929664969
- https://git.kernel.org/stable/c/1acab790b7cecd4e144d1d18bdfe549e282f6b0b
- https://git.kernel.org/stable/c/0149fdb50a30944827acf9600a2cc44de0325a7f
- https://git.kernel.org/stable/c/39132f166ca8ce00ae60d8a9068e06a60943cc4b
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.