CVE-2026-74456 - Vulnerability Details

- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error

Description

In the Linux kernel, the following vulnerability has been resolved:

can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error

In peak_usb_start(), each RX URB transfer buffer is allocated with kmalloc()
and the URB is flagged URB_FREE_BUFFER so that the final usb_free_urb() also
frees the transfer buffer.

If usb_submit_urb() fails, the error path frees the buffer explicitly with
kfree(buf) and then calls usb_free_urb(urb). Because URB_FREE_BUFFER is set,
usb_free_urb() -> urb_destroy() frees the same buffer a second time, a double
free of the transfer buffer.

BUG: KASAN: double-free in usb_free_urb.part.0+0x91/0xb0
Free of addr ffff8881069ccb80 by task trigger.sh/285

Call Trace:
kfree+0x113/0x3c0
usb_free_urb.part.0+0x91/0xb0

Drop the redundant kfree(buf); usb_free_urb() already releases the transfer
buffer. This mirrors commit 03819abbeb11 ("net: usb: lan78xx: Fix double free
issue with interrupt buffer allocation").

Published: 2026-08-15

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux peak_usb driver, a double free occurs when a URB submission fails. The driver allocates a transfer buffer and sets URB_FREE_BUFFER so that usb_free_urb() will release it. On error the code also explicitly frees the buffer with kfree, resulting in a second free. This double free can corrupt kernel memory, leading to denial of service or, if exploited, enabling arbitrary code execution in kernel mode.

Affected Systems

All releases of the Linux kernel that include the peak_usb driver without the patch that removes the redundant kfree. The flaw applies to any system running those kernel versions.

Risk and Exploitability

The vulnerability is a classic double free, a high-severity kernel memory corruption flaw with a CVSS score of 7.8. The EPSS score is < 1% and the issue is not listed in the KEV catalog. Based on the description, it is inferred that an attacker could supply a malicious USB device that causes the URB submission to fail, potentially leading to arbitrary code execution with kernel privileges. The attack vector requires interaction with the USB subsystem, which may be local or remote depending on device exposure.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d`	affected	< 914c3b8fa175acf8476ad31cf04e308638e3578e
`bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d`	affected	< 5f2fa5840c34d3a558c57855781be75e03bef752
`bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d`	affected	< b9088d581fff971a7eb1628f8dcc30df6cfef4dc
`bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d`	affected	< 525640b93d3e5f82f4ebea4730f4e0cf799522ba
`bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d`	affected	< 4bb3325075138dd5346b71589a959878b564dc0b
`bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d`	affected	< 92d0de80ca2223b9c7da78020155b6cb27824cc0
`bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d`	affected	< dfb17bf04a764462000f11258a7c06aa92d1f261
`bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d`	affected	< 9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9

Linux

affected

Version	Status	Constraints
`3.4`	affected	—
`0`	unaffected	< 3.4
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.151`	unaffected	≤ 6.6.*
`6.12.103`	unaffected	≤ 6.12.*
`6.18.44`	unaffected	≤ 6.18.*
`7.1.8`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d,525640b93d3e5f82f4ebea4730f4e0cf799522ba)`	affected	code_commit	—
`[bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d,4bb3325075138dd5346b71589a959878b564dc0b)`	affected	code_commit	—
`[bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d,92d0de80ca2223b9c7da78020155b6cb27824cc0)`	affected	code_commit	—
`[bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d,dfb17bf04a764462000f11258a7c06aa92d1f261)`	affected	code_commit	—
`[bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d,9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.4`	affected	semver	—
`[0,3.4)`	unaffected	semver	—
`[6.6.151,6.6.*]`	unaffected	generic	—
`[6.12.103,6.12.*]`	unaffected	generic	—
`[6.18.44,6.18.*]`	unaffected	generic	—
`[7.1.8,7.1.*]`	unaffected	generic	—
`[7.2-rc6,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update to the latest Linux kernel release that includes the commit removing the redundant kfree in peak_usb_start.
If an immediate kernel update is not possible, apply the patch directly to the source code or compile a backported kernel containing the fix.
Constrain USB device usage – restrict the USB subsystem to trusted devices or disable unnecessary USB drivers so that the vulnerable code path cannot be invoked.

Generated by OpenCVE AI on August 18, 2026 at 04:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6466-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00129.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/4bb3325075138dd5346b71589a959878b564dc0b
https://git.kernel.org/stable/c/525640b93d3e5f82f4ebea4730f4e0cf799522ba
https://git.kernel.org/stable/c/5f2fa5840c34d3a558c57855781be75e03bef752
https://git.kernel.org/stable/c/914c3b8fa175acf8476ad31cf04e308638e3578e
https://git.kernel.org/stable/c/92d0de80ca2223b9c7da78020155b6cb27824cc0
https://git.kernel.org/stable/c/9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9
https://git.kernel.org/stable/c/b9088d581fff971a7eb1628f8dcc30df6cfef4dc
https://git.kernel.org/stable/c/dfb17bf04a764462000f11258a7c06aa92d1f261
https://lore.kernel.org/linux-cve-announce/2026081531-CVE-2026-74456-eadc@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74456
https://www.cve.org/CVERecord?id=CVE-2026-74456

History

Wed, 19 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/5f2fa5840c34d3a558c57855781be75e03bef752 https://git.kernel.org/stable/c/914c3b8fa175acf8476ad31cf04e308638e3578e https://git.kernel.org/stable/c/b9088d581fff971a7eb1628f8dcc30df6cfef4dc

Tue, 18 Aug 2026 03:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Tue, 18 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1341
References		https://lore.kernel.org/linux-cve-announce/2026081531-CVE-2026-74456-eadc@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74456 https://www.cve.org/CVERecord?id=CVE-2026-74456
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 15 Aug 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error In peak_usb_start(), each RX URB transfer buffer is allocated with kmalloc() and the URB is flagged URB_FREE_BUFFER so that the final usb_free_urb() also frees the transfer buffer. If usb_submit_urb() fails, the error path frees the buffer explicitly with kfree(buf) and then calls usb_free_urb(urb). Because URB_FREE_BUFFER is set, usb_free_urb() -> urb_destroy() frees the same buffer a second time, a double free of the transfer buffer. BUG: KASAN: double-free in usb_free_urb.part.0+0x91/0xb0 Free of addr ffff8881069ccb80 by task trigger.sh/285 Call Trace: kfree+0x113/0x3c0 usb_free_urb.part.0+0x91/0xb0 Drop the redundant kfree(buf); usb_free_urb() already releases the transfer buffer. This mirrors commit 03819abbeb11 ("net: usb: lan78xx: Fix double free issue with interrupt buffer allocation").
Title		can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4bb3325075138dd5346b71589a959878b564dc0b https://git.kernel.org/stable/c/525640b93d3e5f82f4ebea4730f4e0cf799522ba https://git.kernel.org/stable/c/92d0de80ca2223b9c7da78020155b6cb27824cc0 https://git.kernel.org/stable/c/9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9 https://git.kernel.org/stable/c/dfb17bf04a764462000f11258a7c06aa92d1f261

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T12:26:58.808Z

Updated: 2026-08-19T16:36:51.237Z

Reserved: 2026-08-15T05:44:03.900Z

Link: CVE-2026-74456

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T13:17:50.227

Modified: 2026-08-19T17:21:02.377

Link: CVE-2026-74456

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74456 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-18T04:30:06Z

Weaknesses

CWE-1341
Multiple Releases of Same Resource or Handle

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object