-

CVE-2026-74457

can: peak_usb: add bounds check for USB channel index

In the Linux kernel, the following vulnerability has been resolved:

can: peak_usb: add bounds check for USB channel index

The channel control index ctrl_idx is derived from rx->len which comes
directly from a device USB payload. The mask 0x0f allows values 0-15, but
the array size of usb_if->dev[] is only 2. Values 2-15 cause heap
out-of-bounds read, eventually causing kernel panic in the IRQ context.

Add bounds checking for ctrl_idx before the array access in both
pcan_usb_pro_handle_canmsg() and pcan_usb_pro_handle_error().
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version d8a199355f8f8a0797c00d98788d7282c9ea38bd
Version < 18b1a868a2cda66fb438007ba47ce5f2484db381
Status affected
Version d8a199355f8f8a0797c00d98788d7282c9ea38bd
Version < 0c9268457bd6e4058fe55b4db01b16661c2eacf5
Status affected
Version d8a199355f8f8a0797c00d98788d7282c9ea38bd
Version < 94fb6fe83ce152532b11b36730b30f3dc0c94217
Status affected
Version d8a199355f8f8a0797c00d98788d7282c9ea38bd
Version < 825c903ca3c98cd0cf0e3de8ab8f2604a5339b3f
Status affected
Version d8a199355f8f8a0797c00d98788d7282c9ea38bd
Version < f97b7e5e1cdaae15cd95b3a360028c7929664969
Status affected
Version d8a199355f8f8a0797c00d98788d7282c9ea38bd
Version < 1acab790b7cecd4e144d1d18bdfe549e282f6b0b
Status affected
Version d8a199355f8f8a0797c00d98788d7282c9ea38bd
Version < 0149fdb50a30944827acf9600a2cc44de0325a7f
Status affected
Version d8a199355f8f8a0797c00d98788d7282c9ea38bd
Version < 39132f166ca8ce00ae60d8a9068e06a60943cc4b
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 3.4
Status affected
Version 0
Version < 3.4
Status unaffected
Version <= 5.10.*
Version 5.10.265
Status unaffected
Version <= 5.15.*
Version 5.15.216
Status unaffected
Version <= 6.1.*
Version 6.1.183
Status unaffected
Version <= 6.6.*
Version 6.6.151
Status unaffected
Version <= 6.12.*
Version 6.12.103
Status unaffected
Version <= 6.18.*
Version 6.18.44
Status unaffected
Version <= 7.1.*
Version 7.1.8
Status unaffected
Version <= *
Version 7.2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.18% 0.075
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/825c903ca3c98cd0cf0e3de8ab8f2604a5339b3f
https://git.kernel.org/stable/c/f97b7e5e1cdaae15cd95b3a360028c7929664969
https://git.kernel.org/stable/c/1acab790b7cecd4e144d1d18bdfe549e282f6b0b
https://git.kernel.org/stable/c/0149fdb50a30944827acf9600a2cc44de0325a7f
https://git.kernel.org/stable/c/39132f166ca8ce00ae60d8a9068e06a60943cc4b
https://git.kernel.org/stable/c/0c9268457bd6e4058fe55b4db01b16661c2eacf5
https://git.kernel.org/stable/c/18b1a868a2cda66fb438007ba47ce5f2484db381
https://git.kernel.org/stable/c/94fb6fe83ce152532b11b36730b30f3dc0c94217