CVE-2026-74458 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
The wait and bulk receive paths walk variable-length commands from a USB buffer. A nonzero command shorter than CMD_HEADER_LEN can still be dispatched, and the wait path copies a matching command into a fixed caller-owned struct kvaser_cmd using the device-provided length.
Reject nonzero commands that do not contain the fixed header or that extend beyond the current USB buffer item. In the wait path, also reject a matching command that exceeds the destination before copying it.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides in the Linux kernel's CAN (Controller Area Network) subsystem, specifically within the kvaser_usb_leaf driver that manages communication with Kvaser USB CAN devices. This flaw manifests in the command processing logic where the system fails to properly validate the length and structure of received USB commands during both wait and bulk receive operations. The issue stems from insufficient input validation mechanisms that allow malformed or truncated commands to proceed through the processing pipeline, potentially leading to memory corruption and system instability.
The technical implementation flaw occurs when variable-length commands are parsed from USB buffer data structures. The kernel's command handling code does not adequately verify that received commands contain a complete header structure before attempting to process them. Specifically, when a command has a nonzero length but falls short of the minimum CMD_HEADER_LEN requirement, the system still attempts to dispatch it. Additionally, the wait path copies command data into a fixed-size caller-owned struct kvaser_cmd without validating that the device-provided length parameter does not exceed the destination buffer capacity. This creates potential for buffer overflow conditions where data from the USB buffer could overwrite adjacent memory regions.
The operational impact of this vulnerability extends beyond simple memory corruption to potentially enable privilege escalation and system compromise within automotive and industrial control environments where CAN networks are prevalent. Attackers could exploit this flaw by crafting malicious USB commands that trigger the vulnerable code path, potentially leading to denial of service conditions or unauthorized access to critical systems. The vulnerability affects automotive applications, industrial automation systems, and any environment relying on Linux-based CAN communication through Kvaser USB devices, making it particularly concerning for safety-critical applications where system reliability is paramount.
Mitigation strategies should focus on implementing comprehensive input validation at multiple layers of the command processing pipeline. The fix requires modifying both the wait and bulk receive paths to enforce strict validation checks before any command processing occurs. The solution must reject commands that do not contain complete headers or that extend beyond the current USB buffer boundaries, while also ensuring that matching commands do not exceed the fixed destination buffer size during copy operations. This vulnerability aligns with CWE-129 Input Validation and CWE-787 Out-of-bounds Write categories, and represents a potential ATT&CK technique involving privilege escalation through kernel memory corruption. System administrators should apply kernel updates immediately and consider implementing additional network segmentation controls for CAN-based systems to limit attack surface exposure.