CVE-2026-74458 (GCVE-0-2026-74458)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-08-19 16:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
The wait and bulk receive paths walk variable-length commands from a
USB buffer. A nonzero command shorter than CMD_HEADER_LEN can still be
dispatched, and the wait path copies a matching command into a fixed
caller-owned struct kvaser_cmd using the device-provided length.
Reject nonzero commands that do not contain the fixed header or that
extend beyond the current USB buffer item. In the wait path, also reject
a matching command that exceeds the destination before copying it.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 080f40a6fa28dab299da7a652e444b1e2d9231e7 Version: 080f40a6fa28dab299da7a652e444b1e2d9231e7 Version: 080f40a6fa28dab299da7a652e444b1e2d9231e7 Version: 080f40a6fa28dab299da7a652e444b1e2d9231e7 Version: 080f40a6fa28dab299da7a652e444b1e2d9231e7 Version: 080f40a6fa28dab299da7a652e444b1e2d9231e7 Version: 080f40a6fa28dab299da7a652e444b1e2d9231e7 Version: 080f40a6fa28dab299da7a652e444b1e2d9231e7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c00ec53d7dec08134e97071850cc00ef000c5b77",
"status": "affected",
"version": "080f40a6fa28dab299da7a652e444b1e2d9231e7",
"versionType": "git"
},
{
"lessThan": "d9e91672526ffa279709b15490118aea1bdee714",
"status": "affected",
"version": "080f40a6fa28dab299da7a652e444b1e2d9231e7",
"versionType": "git"
},
{
"lessThan": "72f96c2942f11a0ae8663adcb3d9ee986e07d4fa",
"status": "affected",
"version": "080f40a6fa28dab299da7a652e444b1e2d9231e7",
"versionType": "git"
},
{
"lessThan": "695aea154bb2d453e6daada1510972fafd075285",
"status": "affected",
"version": "080f40a6fa28dab299da7a652e444b1e2d9231e7",
"versionType": "git"
},
{
"lessThan": "3d0897ec623e422695d70d80ae456f89476c5328",
"status": "affected",
"version": "080f40a6fa28dab299da7a652e444b1e2d9231e7",
"versionType": "git"
},
{
"lessThan": "185cb1fa38142a3cbf223dd8b3abb24217f330d3",
"status": "affected",
"version": "080f40a6fa28dab299da7a652e444b1e2d9231e7",
"versionType": "git"
},
{
"lessThan": "21f0465fd86d77794aaed8e05f833634f68d178d",
"status": "affected",
"version": "080f40a6fa28dab299da7a652e444b1e2d9231e7",
"versionType": "git"
},
{
"lessThan": "0293dd153f9dbc1ddf5dacdccc76b363bce4a8ee",
"status": "affected",
"version": "080f40a6fa28dab299da7a652e444b1e2d9231e7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents\n\nThe wait and bulk receive paths walk variable-length commands from a\nUSB buffer. A nonzero command shorter than CMD_HEADER_LEN can still be\ndispatched, and the wait path copies a matching command into a fixed\ncaller-owned struct kvaser_cmd using the device-provided length.\n\nReject nonzero commands that do not contain the fixed header or that\nextend beyond the current USB buffer item. In the wait path, also reject\na matching command that exceeds the destination before copying it."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:36:54.341Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c00ec53d7dec08134e97071850cc00ef000c5b77"
},
{
"url": "https://git.kernel.org/stable/c/d9e91672526ffa279709b15490118aea1bdee714"
},
{
"url": "https://git.kernel.org/stable/c/72f96c2942f11a0ae8663adcb3d9ee986e07d4fa"
},
{
"url": "https://git.kernel.org/stable/c/695aea154bb2d453e6daada1510972fafd075285"
},
{
"url": "https://git.kernel.org/stable/c/3d0897ec623e422695d70d80ae456f89476c5328"
},
{
"url": "https://git.kernel.org/stable/c/185cb1fa38142a3cbf223dd8b3abb24217f330d3"
},
{
"url": "https://git.kernel.org/stable/c/21f0465fd86d77794aaed8e05f833634f68d178d"
},
{
"url": "https://git.kernel.org/stable/c/0293dd153f9dbc1ddf5dacdccc76b363bce4a8ee"
}
],
"title": "can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74458",
"datePublished": "2026-08-15T12:27:00.053Z",
"dateReserved": "2026-08-15T05:44:03.900Z",
"dateUpdated": "2026-08-19T16:36:54.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…