CVE-2026-74456
In the Linux kernel, the following vulnerability has been resolved:
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
In peak_usb_start(), each RX URB transfer buffer is allocated with kmalloc()
and the URB is flagged URB_FREE_BUFFER so that the final usb_free_urb() also
frees the transfer buffer.
If usb_submit_urb() fails, the error path frees the buffer explicitly with
kfree(buf) and then calls usb_free_urb(urb). Because URB_FREE_BUFFER is set,
usb_free_urb() -> urb_destroy() frees the same buffer a second time, a double
free of the transfer buffer.
BUG: KASAN: double-free in usb_free_urb.part.0+0x91/0xb0
Free of addr ffff8881069ccb80 by task trigger.sh/285
Call Trace:
kfree+0x113/0x3c0
usb_free_urb.part.0+0x91/0xb0
Drop the redundant kfree(buf); usb_free_urb() already releases the transfer
buffer. This mirrors commit 03819abbeb11 ("net: usb: lan78xx: Fix double free
issue with interrupt buffer allocation").
CSIRTS triage
- What
- Double free of transfer buffer in peak_usb_start() on URB submission error.
- Who is affected
- Systems running affected Linux kernel versions with peak_usb CAN driver when device URB submission fails.
- Urgency
- Low; double free requires error path trigger but can cause kernel crash or memory corruption.
- Action
- Apply kernel patch removing duplicate buffer free or update to patched kernel version.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-74456
Get an email if CVE-2026-74456 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all EPSS-scored CVEs.
Advisory coverage (3)
- unknownDSA-6466-1 linux - security updatedebian · 2026-08-25
- highCVE-2026-74456: In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: peak_usb_st…nvd · 2026-08-15
- lowCVE-2026-74456: can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit errormsrc · 2026-08-11
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-74456)