In the Linux kernel, the following vulnerability has been resolved:

can: peak_usb: add bounds check for USB channel index

The channel control index ctrl_idx is derived from rx->len which comes
directly from a device USB payload. The mask 0x0f allows values 0-15, but
the array size of usb_if->dev[] is only 2. Values 2-15 cause heap
out-of-bounds read, eventually causing kernel panic in the IRQ context.

Add bounds checking for ctrl_idx before the array access in both
pcan_usb_pro_handle_canmsg() and pcan_usb_pro_handle_error().

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
d8a199355f8f8a0797c00d98788d7282c9ea38bd affected < 825c903ca3c98cd0cf0e3de8ab8f2604a5339b3f
d8a199355f8f8a0797c00d98788d7282c9ea38bd affected < f97b7e5e1cdaae15cd95b3a360028c7929664969
d8a199355f8f8a0797c00d98788d7282c9ea38bd affected < 1acab790b7cecd4e144d1d18bdfe549e282f6b0b
d8a199355f8f8a0797c00d98788d7282c9ea38bd affected < 0149fdb50a30944827acf9600a2cc44de0325a7f
d8a199355f8f8a0797c00d98788d7282c9ea38bd affected < 39132f166ca8ce00ae60d8a9068e06a60943cc4b
Linux Linux affected
Version Status Constraints
3.4 affected —
0 unaffected < 3.4
6.6.151 unaffected ≤ 6.6.*
6.12.103 unaffected ≤ 6.12.*
6.18.44 unaffected ≤ 6.18.*
7.1.8 unaffected ≤ 7.1.*
7.2-rc6 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0149fdb50a30944827acf9600a2cc44de0325a7f cve-icon cve-icon
https://git.kernel.org/stable/c/1acab790b7cecd4e144d1d18bdfe549e282f6b0b cve-icon cve-icon
https://git.kernel.org/stable/c/39132f166ca8ce00ae60d8a9068e06a60943cc4b cve-icon cve-icon
https://git.kernel.org/stable/c/825c903ca3c98cd0cf0e3de8ab8f2604a5339b3f cve-icon cve-icon
https://git.kernel.org/stable/c/f97b7e5e1cdaae15cd95b3a360028c7929664969 cve-icon cve-icon
History

Sat, 15 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-127
CWE-129

Sat, 15 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: add bounds check for USB channel index The channel control index ctrl_idx is derived from rx->len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usb_if->dev[] is only 2. Values 2-15 cause heap out-of-bounds read, eventually causing kernel panic in the IRQ context. Add bounds checking for ctrl_idx before the array access in both pcan_usb_pro_handle_canmsg() and pcan_usb_pro_handle_error().
Title can: peak_usb: add bounds check for USB channel index
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T12:26:59.411Z

Reserved: 2026-08-15T05:44:03.900Z

Link: CVE-2026-74457

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T13:17:50.333

Modified: 2026-08-15T13:17:50.333

Link: CVE-2026-74457

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-15T16:15:03Z

Weaknesses