CVE-2026-74457: can: peak_usb: add bounds check for USB channel index
can: peakusb: add bounds check for USB channel index
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1 - Configuration
Implement bounds checking for the derived channel control index ctrl_idx before accessing the array usb_if->dev[ctrl_idx] in both pcan_usb_pro_handle_canmsg() and pcan_usb_pro_handle_error(), ensuring ctrl_idx is less than the array size (only 2 elements). This prevents out-of-bounds reads from IRQ-context kernel panics.
Linux kernel (pcan_usb_pro) Add bounds checking for ctrl_idx before array access to usb_if->dev[ctrl_idx] (ensure ctrl_idx is within array bounds) = N/A
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74457?
CVE-2026-74457 has a risk rating of 53, indicating a moderate level of vulnerability.
How do I fix CVE-2026-74457?
To fix CVE-2026-74457, update the Linux kernel to the latest version where this vulnerability has been resolved.
What does CVE-2026-74457 affect?
CVE-2026-74457 affects the USB channel control index in the Linux kernel related to CAN protocols.
What is the risk of exploitation for CVE-2026-74457?
The exploitation risk of CVE-2026-74457 can lead to potential access violations or memory corruption due to improper bounds checking.
When was CVE-2026-74457 published?
CVE-2026-74457 was published on August 15, 2026.