CVE-2026-74458can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents The wait and bulk receive paths walk variable-length commands from a USB buffer. A nonzero command shorter than CMD_HEADER_LEN can still be dispatched, and the wait path copies a matching command into a fixed caller-owned struct kvaser_cmd using the device-provided length. Reject nonzero commands that do not contain the fixed header or that extend beyond the current USB buffer item. In the wait path, also reject a matching command that exceeds the destination before copying it.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 080f40a6fa28dab299da7a652e444b1e2d9231e7 before c00ec53d7dec08134e97071850cc00ef000c5b77; from 080f40a6fa28dab299da7a652e444b1e2d9231e7 before d9e91672526ffa279709b15490118aea1bdee714; 080f40a6fa28dab299da7a652e444b1e2d9231e7 builds before 72f96c2942f11a0ae8663adcb3d9ee986e07d4fa; from 080f40a6fa28dab299da7a652e444b1e2d9231e7 before 695aea154bb2d453e6daada1510972fafd075285; 080f40a6fa28dab299da7a652e444b1e2d9231e7 builds before 3d0897ec623e422695d70d80ae456f89476c5328; from 080f40a6fa28dab299da7a652e444b1e2d9231e7 before 185cb1fa38142a3cbf223dd8b3abb24217f330d3; 080f40a6fa28dab299da7a652e444b1e2d9231e7 builds before 21f0465fd86d77794aaed8e05f833634f68d178d; from 080f40a6fa28dab299da7a652e444b1e2d9231e7 before 0293dd153f9dbc1ddf5dacdccc76b363bce4a8ee | CNA record |
References
- https://git.kernel.org/stable/c/c00ec53d7dec08134e97071850cc00ef000c5b77
- https://git.kernel.org/stable/c/d9e91672526ffa279709b15490118aea1bdee714
- https://git.kernel.org/stable/c/72f96c2942f11a0ae8663adcb3d9ee986e07d4fa
- https://git.kernel.org/stable/c/695aea154bb2d453e6daada1510972fafd075285
- https://git.kernel.org/stable/c/3d0897ec623e422695d70d80ae456f89476c5328
- https://git.kernel.org/stable/c/185cb1fa38142a3cbf223dd8b3abb24217f330d3
- https://git.kernel.org/stable/c/21f0465fd86d77794aaed8e05f833634f68d178d
- https://git.kernel.org/stable/c/0293dd153f9dbc1ddf5dacdccc76b363bce4a8ee
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.