CVE-2026-74456

Received Received - Intake

Double Free in Linux Kernel CAN Peak_USB Driver

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error In peak_usb_start(), each RX URB transfer buffer is allocated with kmalloc() and the URB is flagged URB_FREE_BUFFER so that the final usb_free_urb() also frees the transfer buffer. If usb_submit_urb() fails, the error path frees the buffer explicitly with kfree(buf) and then calls usb_free_urb(urb). Because URB_FREE_BUFFER is set, usb_free_urb() -> urb_destroy() frees the same buffer a second time, a double free of the transfer buffer. BUG: KASAN: double-free in usb_free_urb.part.0+0x91/0xb0 Free of addr ffff8881069ccb80 by task trigger.sh/285 Call Trace: kfree+0x113/0x3c0 usb_free_urb.part.0+0x91/0xb0 Drop the redundant kfree(buf); usb_free_urb() already releases the transfer buffer. This mirrors commit 03819abbeb11 ("net: usb: lan78xx: Fix double free issue with interrupt buffer allocation").

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-05

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74456

EUVD

EUVD-2026-59649

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a double-free vulnerability in the Linux kernel's CAN (Controller Area Network) subsystem, specifically in the peak_usb driver. When submitting a USB request block (URB) for data transfer, the driver allocates a buffer and sets a flag to automatically free it later. If the URB submission fails, the error handling code incorrectly frees the buffer manually before the URB cleanup process, causing the same memory to be freed twice.

Detection Guidance

This vulnerability is specific to the Linux kernel's CAN subsystem and the peak_usb driver. Detection requires checking for kernel logs indicating a double-free error in usb_free_urb. Monitor dmesg or system logs for KASAN reports mentioning 'double-free' or 'usb_free_urb'.

Impact Analysis

This vulnerability could cause kernel memory corruption, leading to system crashes, data corruption, or potential privilege escalation. Systems using the peak_usb CAN adapter may experience instability or unexpected behavior when handling USB CAN communication.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a kernel-level memory management issue that could lead to system instability or crashes but does not involve data breaches or unauthorized access.

Mitigation Strategies

Update your Linux kernel to a patched version where this issue is resolved. If using a vulnerable kernel, avoid using the peak_usb driver for CAN interfaces until patched. Check kernel version with 'uname -r' and verify if peak_usb is loaded with 'lsmod | grep peak_usb'.

Hi! I’m here to help you understand CVE-2026-74456. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70