CVE-2026-74457

Received Received - Intake

Heap Out-of-Bounds Read in PCAN-USB Pro Linux Kernel Driver

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: add bounds check for USB channel index The channel control index ctrl_idx is derived from rx->len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usb_if->dev[] is only 2. Values 2-15 cause heap out-of-bounds read, eventually causing kernel panic in the IRQ context. Add bounds checking for ctrl_idx before the array access in both pcan_usb_pro_handle_canmsg() and pcan_usb_pro_handle_error().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74457

EUVD

EUVD-2026-59650

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a heap out-of-bounds read vulnerability in the Linux kernel's CAN (Controller Area Network) subsystem, specifically in the peak_usb driver. It occurs when a malicious USB device sends a payload with a crafted length value that leads to an invalid channel index being used to access an array with only 2 elements. The index is derived from the payload length but masked to 0-15, while the array size is only 2, causing out-of-bounds access when the index is 2-15. This can trigger a kernel panic during IRQ handling.

Detection Guidance

This vulnerability affects the Linux kernel's CAN USB driver (peak_usb). Detection requires checking kernel logs for heap out-of-bounds read errors or kernel panics related to pcan_usb_pro_handle_canmsg() or pcan_usb_pro_handle_error(). Use 'dmesg | grep -i pcan_usb' or 'journalctl -k | grep -i pcan_usb' to search for related errors.

Impact Analysis

If you use a system with the affected Linux kernel version and a CAN device using the peak_usb driver, an attacker with physical access could exploit this by connecting a malicious USB device. This may cause the system to crash with a kernel panic, leading to denial of service. The impact is limited to systems using this specific driver and CAN hardware.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a kernel-level issue causing potential system crashes due to heap out-of-bounds reads, which could indirectly impact system availability and data integrity but does not specifically violate regulatory requirements.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this issue. If an update is unavailable, disable the peak_usb module using 'modprobe -r peak_usb' until a patch is applied. Monitor vendor advisories for kernel updates.

Hi! I’m here to help you understand CVE-2026-74457. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70