7.8

CVE-2026-74456

can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error

In the Linux kernel, the following vulnerability has been resolved:

can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error

In peak_usb_start(), each RX URB transfer buffer is allocated with kmalloc()
and the URB is flagged URB_FREE_BUFFER so that the final usb_free_urb() also
frees the transfer buffer.

If usb_submit_urb() fails, the error path frees the buffer explicitly with
kfree(buf) and then calls usb_free_urb(urb). Because URB_FREE_BUFFER is set,
usb_free_urb() -> urb_destroy() frees the same buffer a second time, a double
free of the transfer buffer.

  BUG: KASAN: double-free in usb_free_urb.part.0+0x91/0xb0
  Free of addr ffff8881069ccb80 by task trigger.sh/285

  Call Trace:
   kfree+0x113/0x3c0
   usb_free_urb.part.0+0x91/0xb0

Drop the redundant kfree(buf); usb_free_urb() already releases the transfer
buffer. This mirrors commit 03819abbeb11 ("net: usb: lan78xx: Fix double free
issue with interrupt buffer allocation").
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d
Version < 914c3b8fa175acf8476ad31cf04e308638e3578e
Status affected
Version bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d
Version < 5f2fa5840c34d3a558c57855781be75e03bef752
Status affected
Version bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d
Version < b9088d581fff971a7eb1628f8dcc30df6cfef4dc
Status affected
Version bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d
Version < 525640b93d3e5f82f4ebea4730f4e0cf799522ba
Status affected
Version bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d
Version < 4bb3325075138dd5346b71589a959878b564dc0b
Status affected
Version bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d
Version < 92d0de80ca2223b9c7da78020155b6cb27824cc0
Status affected
Version bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d
Version < dfb17bf04a764462000f11258a7c06aa92d1f261
Status affected
Version bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d
Version < 9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 3.4
Status affected
Version 0
Version < 3.4
Status unaffected
Version <= 5.10.*
Version 5.10.265
Status unaffected
Version <= 5.15.*
Version 5.15.216
Status unaffected
Version <= 6.1.*
Version 6.1.183
Status unaffected
Version <= 6.6.*
Version 6.6.151
Status unaffected
Version <= 6.12.*
Version 6.12.103
Status unaffected
Version <= 6.18.*
Version 6.18.44
Status unaffected
Version <= 7.1.*
Version 7.1.8
Status unaffected
Version <= *
Version 7.2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.13% 0.029
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/525640b93d3e5f82f4ebea4730f4e0cf799522ba
https://git.kernel.org/stable/c/4bb3325075138dd5346b71589a959878b564dc0b
https://git.kernel.org/stable/c/92d0de80ca2223b9c7da78020155b6cb27824cc0
https://git.kernel.org/stable/c/dfb17bf04a764462000f11258a7c06aa92d1f261
https://git.kernel.org/stable/c/9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9
https://git.kernel.org/stable/c/5f2fa5840c34d3a558c57855781be75e03bef752
https://git.kernel.org/stable/c/914c3b8fa175acf8476ad31cf04e308638e3578e
https://git.kernel.org/stable/c/b9088d581fff971a7eb1628f8dcc30df6cfef4dc