High 7.8Published Aug 15, 2026

CVE-2026-74456can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error

Updated under an hour ago (Oct 27, 2026, 2:10 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error In peak_usb_start(), each RX URB transfer buffer is allocated with kmalloc() and the URB is flagged URB_FREE_BUFFER so that the final usb_free_urb() also frees the transfer buffer. If usb_submit_urb() fails, the error path frees the buffer explicitly with kfree(buf) and then calls usb_free_urb(urb). Because URB_FREE_BUFFER is set, usb_free_urb() -> urb_destroy() frees the same buffer a second time, a double free of the transfer buffer. BUG: KASAN: double-free in usb_free_urb.part.0+0x91/0xb0 Free of addr ffff8881069ccb80 by task trigger.sh/285 Call Trace: kfree+0x113/0x3c0 usb_free_urb.part.0+0x91/0xb0 Drop the redundant kfree(buf); usb_free_urb() already releases the transfer buffer. This mirrors commit 03819abbeb11 ("net: usb: lan78xx: Fix double free issue with interrupt buffer allocation").

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d before 914c3b8fa175acf8476ad31cf04e308638e3578e; from bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d before 5f2fa5840c34d3a558c57855781be75e03bef752; from bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d before b9088d581fff971a7eb1628f8dcc30df6cfef4dc; from bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d before 525640b93d3e5f82f4ebea4730f4e0cf799522ba; from bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d before 4bb3325075138dd5346b71589a959878b564dc0b; from bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d before 92d0de80ca2223b9c7da78020155b6cb27824cc0; from bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d before dfb17bf04a764462000f11258a7c06aa92d1f261; from bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d before 9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9	CNA record

References

References

https://git.kernel.org/stable/c/914c3b8fa175acf8476ad31cf04e308638e3578e
https://git.kernel.org/stable/c/5f2fa5840c34d3a558c57855781be75e03bef752
https://git.kernel.org/stable/c/b9088d581fff971a7eb1628f8dcc30df6cfef4dc
https://git.kernel.org/stable/c/525640b93d3e5f82f4ebea4730f4e0cf799522ba
https://git.kernel.org/stable/c/4bb3325075138dd5346b71589a959878b564dc0b
https://git.kernel.org/stable/c/92d0de80ca2223b9c7da78020155b6cb27824cc0
https://git.kernel.org/stable/c/dfb17bf04a764462000f11258a7c06aa92d1f261
https://git.kernel.org/stable/c/9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.