CVE-2026-74458: can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
In the Linux kernel, the following vulnerability has been resolved:
can: kvaserusbleaf: kvaserusbleafwaitcmd(): validate received command extents
The wait and bulk receive paths walk variable-length commands from a USB buffer. A nonzero command shorter than CMDHEADERLEN can still be dispatched, and the wait path copies a matching command into a fixed caller-owned struct kvasercmd using the device-provided length.
Reject nonzero commands that do not contain the fixed header or that extend beyond the current USB buffer item. In the wait path, also reject a matching command that exceeds the destination before copying it.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74458?
CVE-2026-74458 has a risk rating of 47.
How do I fix CVE-2026-74458?
To fix CVE-2026-74458, ensure that your Linux kernel is updated to the latest version that addresses this vulnerability.
What systems are affected by CVE-2026-74458?
CVE-2026-74458 affects systems running specific versions of the Linux kernel that include the kvaser_usb_leaf driver.
What types of attacks can exploit CVE-2026-74458?
CVE-2026-74458 can be exploited through crafted USB commands, potentially allowing for unauthorized command execution.
Is CVE-2026-74458 being actively exploited in the wild?
As of the latest information, there are no confirmed reports of active exploitation of CVE-2026-74458.