CVE-2026-74455: can: peak_usb: validate uCAN receive record lengths
Published Aug 15, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
can: peakusb: validate uCAN receive record lengths
pcanusbfddecodebuf() walks uCAN records packed in one USB receive buffer.
Require each record to contain the fixed header for its type, and verify CAN payload bytes before copying them into the skb.
Affected Software
1 affected component
Linux Linux kernel
Event History
Aug 15, 2026
CVE Published
via MITRE·12:26 PM
Data Sourced
via MITRE·12:26 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2026-74455?
CVE-2026-74455 has a risk score of 34.
2
How do I fix CVE-2026-74455?
To fix CVE-2026-74455, update your Linux kernel to the patched version that addresses the vulnerability.
3
Who is affected by CVE-2026-74455?
Users of the Linux kernel that utilize the peak_usb CAN interface are potentially affected by CVE-2026-74455.
4
What impact does CVE-2026-74455 have?
CVE-2026-74455 can lead to denial of service or incorrect processing of CAN messages due to the lack of validation in uCAN records.
5
When was CVE-2026-74455 published?
CVE-2026-74455 was published on August 15, 2026.