CVE-2026-64585: can: esd_usb: kill anchored URBs before freeing netdevs
In the Linux kernel, the following vulnerability has been resolved:
can: esdusb: kill anchored URBs before freeing netdevs
esdusbdisconnect() frees each CAN netdev with freecandev() inside its per-netdev loop and only calls unlinkallurbs(dev) afterwards. The per-netdev private data (struct esdusbnetpriv) is embedded in the netdevice allocation returned by alloccandev(), so once freecandev() has run, dev->nets[i] points to freed memory. unlinkallurbs() then dereferences the freed dev->nets[i] to kill the per-netdev TX anchor (usbkillanchoredurbs(&priv->txsubmitted)), clear activetxjobs, and reset priv->txcontexts[].
Reorder the teardown so the anchored URBs are killed before the netdevs are freed, matching other CAN/USB drivers in the same directory such as emsusb, usb8dev and mcbausb, which unregister, then unlink, then free: unregister the netdevs first (which stops their TX queues), call unlinkallurbs(dev) once, then free the netdevs.
This issue was found by an in-house static analysis tool.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64585?
CVE-2026-64585 has a risk rating of 21, indicating significant severity.
How do I fix CVE-2026-64585?
To fix CVE-2026-64585, update to the latest version of the Linux kernel where the vulnerability has been resolved.
What systems are affected by CVE-2026-64585?
CVE-2026-64585 affects the Linux kernel, specifically related to the CAN subsystem and esd_usb driver.
What type of vulnerability is CVE-2026-64585?
CVE-2026-64585 is a kernel vulnerability that involves improper handling of USB URBs during device disconnection.
Can CVE-2026-64585 be exploited remotely?
While explicit remote exploitation information is not provided, vulnerabilities in the kernel can lead to severe impacts if exploited.