The Linux kernel CAN USB driver calculates a channel control index from USB payload length, without validating that the value falls within the permitted range. While only indices 0 and 1 are valid, the driver accepts values 0‑15, causing a heap out‑of-bounds read when indices 2‑15 are used. This memory corruption occurs in interrupt context and can trigger a kernel panic, effectively crashing the system. The weakness is an improper bounds check leading to memory corruption and denial of service, as captured by CWE-125.

All Linux kernels containing the buggy peak_usb code, regardless of distribution, are affected. No specific version information is provided, and the problem exists until the kernel incorporates the bounds check added in the referenced commits.

The CVSS score is 5.5, the EPSS score is < 1%, and it is not listed in the CISA KEV catalog. The likely attack vector is local; an attacker must be able to interact with or supply a malicious USB device processed by the CAN USB driver. When executed, the kernel panic disables the machine, providing a high‑severity denial of service. Although the exploitation scenario requires local access or compromised USB hardware, the fact that the flaw is not listed in KEV does not diminish the urgency of applying a fix.