CVE-2026-74459
Received Received - Intake

RX Buffer Leak in Linux Kernel CAN Driver

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure es58x_read_bulk_callback() resubmits the RX URB after processing a received packet. If the resubmit succeeds, the URB remains anchored and will be handled by the normal RX path or by teardown. However, if usb_submit_urb() fails, the callback unanchors the URB and then returns directly. This skips the existing free_urb path, so the coherent transfer buffer allocated with usb_alloc_coherent() is not released. Reuse the existing free_urb path after a resubmit failure so that the RX coherent buffer is freed before leaving the callback.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74459
EUVD
EUVD-2026-59652

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's CAN bus driver for ETAS ES58X devices. It involves a memory leak in the RX buffer handling. When a USB request block (URB) resubmission fails, the system does not properly free the allocated memory buffer, leading to a resource leak.

Detection Guidance

This vulnerability affects the Linux kernel's CAN bus driver for ETAS ES58x devices. Detection requires checking kernel logs for URB resubmit failures in the es58x driver. Monitor dmesg or journalctl for errors related to usb_submit_urb() failures in the CAN subsystem.

Impact Analysis

The impact is primarily on system stability and resource usage. The memory leak can cause gradual exhaustion of kernel memory, potentially leading to performance degradation or system crashes over time if the affected device is frequently used.

Mitigation Strategies

Apply the Linux kernel patch that fixes the RX buffer leak in es58x_read_bulk_callback(). Update to a patched kernel version. If immediate patching is not possible, disable the affected CAN interface or module until the fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74459. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart