CVE-2026-74457: can: peak_usb: add bounds check for USB channel index
In the Linux kernel, the following vulnerability has been resolved:
can: peakusb: add bounds check for USB channel index
The channel control index ctrlidx is derived from rx->len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usbif->dev[] is only 2. Values 2-15 cause heap out-of-bounds read, eventually causing kernel panic in the IRQ context.
Add bounds checking for ctrlidx before the array access in both pcanusbprohandlecanmsg() and pcanusbprohandleerror().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement bounds checking for the derived channel control index ctrl_idx before accessing the array usb_if->dev[ctrl_idx] in both pcan_usb_pro_handle_canmsg() and pcan_usb_pro_handle_error(), ensuring ctrl_idx is less than the array size (only 2 elements). This prevents out-of-bounds reads from IRQ-context kernel panics.
Linux kernel (pcan_usb_pro) Add bounds checking for ctrl_idx before array access to usb_if->dev[ctrl_idx] (ensure ctrl_idx is within array bounds) = N/A
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74457?
CVE-2026-74457 has a risk rating of 53, indicating a moderate level of vulnerability.
How do I fix CVE-2026-74457?
To fix CVE-2026-74457, update the Linux kernel to the latest version where this vulnerability has been resolved.
What does CVE-2026-74457 affect?
CVE-2026-74457 affects the USB channel control index in the Linux kernel related to CAN protocols.
What is the risk of exploitation for CVE-2026-74457?
The exploitation risk of CVE-2026-74457 can lead to potential access violations or memory corruption due to improper bounds checking.
When was CVE-2026-74457 published?
CVE-2026-74457 was published on August 15, 2026.