CVE-2026-74456 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
In peak_usb_start(), each RX URB transfer buffer is allocated with kmalloc() and the URB is flagged URB_FREE_BUFFER so that the final usb_free_urb() also frees the transfer buffer.
If usb_submit_urb() fails, the error path frees the buffer explicitly with kfree(buf) and then calls usb_free_urb(urb). Because URB_FREE_BUFFER is set, usb_free_urb() -> urb_destroy() frees the same buffer a second time, a double free of the transfer buffer.
BUG: KASAN: double-free in usb_free_urb.part.0+0x91/0xb0 Free of addr ffff8881069ccb80 by task trigger.sh/285
Call Trace: kfree+0x113/0x3c0 usb_free_urb.part.0+0x91/0xb0
Drop the redundant kfree(buf); usb_free_urb() already releases the transfer buffer. This mirrors commit 03819abbeb11 ("net: usb: lan78xx: Fix double free issue with interrupt buffer allocation").
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described represents a critical double free error in the Linux kernel's peak_usb driver component that affects CAN (Controller Area Network) USB device communication. This flaw exists within the peak_usb_start() function where the driver manages receive URB (USB Request Block) transfer buffers for USB communication with automotive and industrial CAN devices. The issue occurs when the USB subsystem fails to submit a URB, triggering an error path that incorrectly handles memory deallocation.
The technical root cause stems from improper memory management practices within the driver's error handling routine. When allocating memory for RX URB transfer buffers, the code uses kmalloc() to obtain memory and sets the URB_FREE_BUFFER flag on the URB structure. This flag instructs the USB subsystem that it should automatically free the transfer buffer when usb_free_urb() is called. However, when usb_submit_urb() returns an error, the driver's error path explicitly calls kfree(buf) to free the buffer before invoking usb_free_urb(urb). This creates a scenario where the same memory address gets freed twice - once by the explicit kfree call and again by the automatic cleanup performed by usb_free_urb() due to the URB_FREE_BUFFER flag.
This double free condition constitutes a serious memory corruption vulnerability that can lead to various security implications and system instability. The kernel's KASAN (Kernel Address Sanitizer) detection confirms the issue by reporting the double-free error at the usb_free_urb.part.0 function, where the second free operation occurs on the same memory address that was already freed by kfree(). This type of vulnerability falls under CWE-415: Double Free and is classified as a memory safety issue that can potentially enable arbitrary code execution or privilege escalation attacks.
The operational impact of this vulnerability extends beyond simple memory corruption, as it affects USB-based CAN device communication systems used in automotive diagnostics, industrial automation, and embedded systems. Systems relying on peak_usb drivers for CAN communication could experience unexpected crashes, data corruption, or potentially provide attackers with opportunities to exploit the memory corruption for privilege escalation. The vulnerability is particularly concerning in automotive environments where CAN bus communication is critical for vehicle operations.
The recommended fix involves removing the redundant kfree(buf) call from the error path, allowing usb_free_urb() to handle all buffer deallocation automatically through its built-in URB_FREE_BUFFER functionality. This solution mirrors a similar fix implemented in the lan78xx network driver (commit 03819abbeb11), demonstrating that this is a well-understood pattern for addressing such double free conditions in USB subsystem drivers. The mitigation approach follows established security best practices for kernel memory management and aligns with ATT&CK technique T1068: Exploitation for Privilege Escalation, as it prevents potential exploitation through memory corruption vulnerabilities. Proper implementation of this fix ensures that the driver maintains correct memory state throughout both successful and error conditions without introducing additional security risks or performance overhead.