CVE-2026-74457
Unknown
Description
In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: add bounds check for USB channel index The channel control index ctrl_idx is derived from rx->len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usb_if->dev[] is only 2. Values 2-15 cause heap out-of-bounds read, eventually causing kernel panic in the IRQ context. Add bounds checking for ctrl_idx before the array access in both pcan_usb_pro_handle_canmsg() and pcan_usb_pro_handle_error().
SeverityUnknown
CVSS—
Exploit probability—
Product
Linux
PublishedAug 15, 2026
First seenAug 15, 2026
How to fix
Update
- Linux Linux18b1a868a2cda66fb438007ba47ce5f2484db381, 0c9268457bd6e4058fe55b4db01b16661c2eacf5, 94fb6fe83ce152532b11b36730b30f3dc0c94217, 825c903ca3c98cd0cf0e3de8ab8f2604a5339b3f, f97b7e5e1cdaae15cd95b3a360028c7929664969, 1acab790b7cecd4e144d1d18bdfe549e282f6b0b, 0149fdb50a30944827acf9600a2cc44de0325a7f, 39132f166ca8ce00ae60d8a9068e06a60943cc4b or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | d8a199355f8f8a0797c00d98788d7282c9ea38bd ≤ v < 18b1a868a2cda66fb438007ba47ce5f2484db381, d8a199355f8f8a0797c00d98788d7282c9ea38bd ≤ v < 0c9268457bd6e4058fe55b4db01b16661c2eacf5, d8a199355f8f8a0797c00d98788d7282c9ea38bd ≤ v < 94fb6fe83ce152532b11b36730b30f3dc0c94217, d8a199355f8f8a0797c00d98788d7282c9ea38bd ≤ v < 825c903ca3c98cd0cf0e3de8ab8f2604a5339b3f, d8a199355f8f8a0797c00d98788d7282c9ea38bd ≤ v < f97b7e5e1cdaae15cd95b3a360028c7929664969, d8a199355f8f8a0797c00d98788d7282c9ea38bd ≤ v < 1acab790b7cecd4e144d1d18bdfe549e282f6b0b, d8a199355f8f8a0797c00d98788d7282c9ea38bd ≤ v < 0149fdb50a30944827acf9600a2cc44de0325a7f, d8a199355f8f8a0797c00d98788d7282c9ea38bd ≤ v < 39132f166ca8ce00ae60d8a9068e06a60943cc4b, 3.4 | 18b1a868a2cda66fb438007ba47ce5f2484db381, 0c9268457bd6e4058fe55b4db01b16661c2eacf5, 94fb6fe83ce152532b11b36730b30f3dc0c94217, 825c903ca3c98cd0cf0e3de8ab8f2604a5339b3f, f97b7e5e1cdaae15cd95b3a360028c7929664969, 1acab790b7cecd4e144d1d18bdfe549e282f6b0b, 0149fdb50a30944827acf9600a2cc44de0325a7f, 39132f166ca8ce00ae60d8a9068e06a60943cc4b |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.