CVE-2026-74456 (GCVE-0-2026-74456)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:26 – Updated: 2026-08-19 16:36
VLAI
Title
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
Summary
In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error In peak_usb_start(), each RX URB transfer buffer is allocated with kmalloc() and the URB is flagged URB_FREE_BUFFER so that the final usb_free_urb() also frees the transfer buffer. If usb_submit_urb() fails, the error path frees the buffer explicitly with kfree(buf) and then calls usb_free_urb(urb). Because URB_FREE_BUFFER is set, usb_free_urb() -> urb_destroy() frees the same buffer a second time, a double free of the transfer buffer. BUG: KASAN: double-free in usb_free_urb.part.0+0x91/0xb0 Free of addr ffff8881069ccb80 by task trigger.sh/285 Call Trace: kfree+0x113/0x3c0 usb_free_urb.part.0+0x91/0xb0 Drop the redundant kfree(buf); usb_free_urb() already releases the transfer buffer. This mirrors commit 03819abbeb11 ("net: usb: lan78xx: Fix double free issue with interrupt buffer allocation").
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < 914c3b8fa175acf8476ad31cf04e308638e3578e (git)
Affected: bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < 5f2fa5840c34d3a558c57855781be75e03bef752 (git)
Affected: bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < b9088d581fff971a7eb1628f8dcc30df6cfef4dc (git)
Affected: bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < 525640b93d3e5f82f4ebea4730f4e0cf799522ba (git)
Affected: bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < 4bb3325075138dd5346b71589a959878b564dc0b (git)
Affected: bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < 92d0de80ca2223b9c7da78020155b6cb27824cc0 (git)
Affected: bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < dfb17bf04a764462000f11258a7c06aa92d1f261 (git)
Affected: bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d , < 9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.4
Unaffected: 0 , < 3.4 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/usb/peak_usb/pcan_usb_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "914c3b8fa175acf8476ad31cf04e308638e3578e",
              "status": "affected",
              "version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
              "versionType": "git"
            },
            {
              "lessThan": "5f2fa5840c34d3a558c57855781be75e03bef752",
              "status": "affected",
              "version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
              "versionType": "git"
            },
            {
              "lessThan": "b9088d581fff971a7eb1628f8dcc30df6cfef4dc",
              "status": "affected",
              "version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
              "versionType": "git"
            },
            {
              "lessThan": "525640b93d3e5f82f4ebea4730f4e0cf799522ba",
              "status": "affected",
              "version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
              "versionType": "git"
            },
            {
              "lessThan": "4bb3325075138dd5346b71589a959878b564dc0b",
              "status": "affected",
              "version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
              "versionType": "git"
            },
            {
              "lessThan": "92d0de80ca2223b9c7da78020155b6cb27824cc0",
              "status": "affected",
              "version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
              "versionType": "git"
            },
            {
              "lessThan": "dfb17bf04a764462000f11258a7c06aa92d1f261",
              "status": "affected",
              "version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
              "versionType": "git"
            },
            {
              "lessThan": "9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9",
              "status": "affected",
              "version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/usb/peak_usb/pcan_usb_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.4"
            },
            {
              "lessThan": "3.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error\n\nIn peak_usb_start(), each RX URB transfer buffer is allocated with kmalloc()\nand the URB is flagged URB_FREE_BUFFER so that the final usb_free_urb() also\nfrees the transfer buffer.\n\nIf usb_submit_urb() fails, the error path frees the buffer explicitly with\nkfree(buf) and then calls usb_free_urb(urb). Because URB_FREE_BUFFER is set,\nusb_free_urb() -\u003e urb_destroy() frees the same buffer a second time, a double\nfree of the transfer buffer.\n\n  BUG: KASAN: double-free in usb_free_urb.part.0+0x91/0xb0\n  Free of addr ffff8881069ccb80 by task trigger.sh/285\n\n  Call Trace:\n   kfree+0x113/0x3c0\n   usb_free_urb.part.0+0x91/0xb0\n\nDrop the redundant kfree(buf); usb_free_urb() already releases the transfer\nbuffer. This mirrors commit 03819abbeb11 (\"net: usb: lan78xx: Fix double free\nissue with interrupt buffer allocation\")."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is only reached when a privileged local actor brings the PEAK CAN netdev up via rtnetlink/ioctl (peak_usb_ndo_open\u2192peak_usb_start); CAN-bus traffic and remote protocols never call this setup path, but the entry is a local syscall rather than USB packet processing.\nAC:L - Any usb_submit_urb() failure on RX setup deterministically hits the broken error path; an attacker can reliably force -ENODEV/-ENOENT by disconnecting/resetting the adapter or presenting a rogue PEAK-class gadget while repeatedly running ip link set canX up/down.\nPR:L - Bringing the CAN interface up requires CAP_NET_ADMIN on RTM_SETLINK (rtnl_setlink/netif_open), which is Low under CNA guidance; on automotive/industrial diagnostic hosts this is commonly held by technician/service accounts even though unauthenticated remote attackers cannot reach the path.\nUI:N - No separate victim interaction is needed beyond the attacker (or their malware) issuing the privileged link-up that enters peak_usb_start; they can also script repeated up/down cycles while manipulating USB state themselves.\nS:U - The double-free corrupts host kernel kmalloc slab state within the peak_usb driver scope and does not by itself cross a security boundary such as VM escape, container breakout, or IOMMU bypass.\nC:H - This is a kmalloc RX-buffer double-free with URB_FREE_BUFFER set; per CNA guidance such heap double-free/UAF-class bugs enable controlled reallocation and arbitrary kernel memory disclosure, not merely a bounded leak.\nI:H - Freeing the same 64\u20132048 byte RX slab object twice corrupts SLUB freelist/metadata and provides a standard heap corruption primitive that can be groomed into arbitrary kernel writes or control-flow hijacking.\nA:H - KASAN already reports a double-free in usb_free_urb() on this path; even without full exploitation, allocator corruption typically causes kernel BUG/oops/panic and repeated trigger cycles can deny CAN/USB service on shared diagnostic systems."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:36:51.237Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/914c3b8fa175acf8476ad31cf04e308638e3578e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f2fa5840c34d3a558c57855781be75e03bef752"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9088d581fff971a7eb1628f8dcc30df6cfef4dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/525640b93d3e5f82f4ebea4730f4e0cf799522ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/4bb3325075138dd5346b71589a959878b564dc0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/92d0de80ca2223b9c7da78020155b6cb27824cc0"
        },
        {
          "url": "https://git.kernel.org/stable/c/dfb17bf04a764462000f11258a7c06aa92d1f261"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9"
        }
      ],
      "title": "can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74456",
    "datePublished": "2026-08-15T12:26:58.808Z",
    "dateReserved": "2026-08-15T05:44:03.900Z",
    "dateUpdated": "2026-08-19T16:36:51.237Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74456",
      "date": "2026-09-21",
      "epss": "0.00129",
      "percentile": "0.02931"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:48:58.000Z",
      "cve": "CVE-2026-74456",
      "id": "msrc_CVE-2026-74456",
      "initial_release_date": "2026-08-23T14:59:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74456.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/can/usb/peak_usb/pcan_usb_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "914c3b8fa175acf8476ad31cf04e308638e3578e",
                    "status": "affected",
                    "version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5f2fa5840c34d3a558c57855781be75e03bef752",
                    "status": "affected",
                    "version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b9088d581fff971a7eb1628f8dcc30df6cfef4dc",
                    "status": "affected",
                    "version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "525640b93d3e5f82f4ebea4730f4e0cf799522ba",
                    "status": "affected",
                    "version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4bb3325075138dd5346b71589a959878b564dc0b",
                    "status": "affected",
                    "version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "92d0de80ca2223b9c7da78020155b6cb27824cc0",
                    "status": "affected",
                    "version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dfb17bf04a764462000f11258a7c06aa92d1f261",
                    "status": "affected",
                    "version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9",
                    "status": "affected",
                    "version": "bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/can/usb/peak_usb/pcan_usb_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.4"
                  },
                  {
                    "lessThan": "3.4",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.265",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.151",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error\n\nIn peak_usb_start(), each RX URB transfer buffer is allocated with kmalloc()\nand the URB is flagged URB_FREE_BUFFER so that the final usb_free_urb() also\nfrees the transfer buffer.\n\nIf usb_submit_urb() fails, the error path frees the buffer explicitly with\nkfree(buf) and then calls usb_free_urb(urb). Because URB_FREE_BUFFER is set,\nusb_free_urb() -\u003e urb_destroy() frees the same buffer a second time, a double\nfree of the transfer buffer.\n\n  BUG: KASAN: double-free in usb_free_urb.part.0+0x91/0xb0\n  Free of addr ffff8881069ccb80 by task trigger.sh/285\n\n  Call Trace:\n   kfree+0x113/0x3c0\n   usb_free_urb.part.0+0x91/0xb0\n\nDrop the redundant kfree(buf); usb_free_urb() already releases the transfer\nbuffer. This mirrors commit 03819abbeb11 (\"net: usb: lan78xx: Fix double free\nissue with interrupt buffer allocation\")."
          }
        ],
        "id": "CVE-2026-74456",
        "lastModified": "2026-08-19T17:21:02.377",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T13:17:50.227",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4bb3325075138dd5346b71589a959878b564dc0b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/525640b93d3e5f82f4ebea4730f4e0cf799522ba"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5f2fa5840c34d3a558c57855781be75e03bef752"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/914c3b8fa175acf8476ad31cf04e308638e3578e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/92d0de80ca2223b9c7da78020155b6cb27824cc0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b9088d581fff971a7eb1628f8dcc30df6cfef4dc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dfb17bf04a764462000f11258a7c06aa92d1f261"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T14:19:28+00:00",
      "cve": "CVE-2026-74456",
      "id": "CVE-2026-74456",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74456.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:06:03Z",
      "cve": "CVE-2026-74456",
      "id": "CVE-2026-74456",
      "initial_release_date": "2026-08-15T23:52:43Z",
      "product_status:known_affected": "317",
      "product_status:known_not_affected": "28",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74456",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74456.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.