CVE-2026-74460 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
can: ems_usb: validate CPC message lengths
ems_usb_read_bulk_callback() walks CPC messages packed in one USB receive buffer.
Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the fields used by the CAN, state, error and overrun handlers.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability identified in the Linux kernel's ems_usb driver represents a critical buffer overflow condition that could lead to arbitrary code execution or system compromise. This issue specifically affects the can subsystem's USB communication handling mechanism where the ems_usb_read_bulk_callback function processes Compact Protocol Container (CPC) messages received through USB bulk transfers. The flaw arises from insufficient validation of message boundaries within the USB receive buffer, creating potential for malicious data injection that could corrupt kernel memory structures.
The technical implementation flaw stems from the driver's failure to properly validate CPC message lengths against the actual USB Request Block (URB) payload dimensions. When processing multiple CPC messages packed within a single USB receive buffer, the function does not verify that each declared message length remains within the bounds of the available URB data. This validation gap allows for scenarios where malformed or oversized messages could cause memory access violations, potentially leading to kernel panics or privilege escalation attacks. The vulnerability specifically impacts the CAN protocol handlers, state management components, error reporting mechanisms, and overrun detection systems that rely on properly structured message payloads.
Operationally, this vulnerability exposes systems using EMS USB CAN adapters to potential remote exploitation, particularly in industrial control systems, automotive networks, and embedded environments where these devices are commonly deployed. Attackers could craft malicious CPC messages that exceed expected boundaries, causing buffer overflows that might be exploited to execute arbitrary code with kernel privileges. The impact extends beyond simple denial of service to include potential data corruption, system instability, and complete compromise of networked embedded systems. This vulnerability is particularly concerning in environments where USB-based CAN communication interfaces are used for critical infrastructure monitoring or control functions.
The mitigation strategy involves implementing comprehensive message length validation within the ems_usb_read_bulk_callback function to ensure each CPC message fits entirely within the URB payload boundaries before processing. Additionally, type-specific payload validation must be enforced to guarantee that required fields for CAN operations, state management, error handling, and overrun detection are properly covered. This fix aligns with common security practices outlined in CWE-129 Input Validation and CWE-787 Out-of-bounds Write categories, while addressing techniques described in the ATT&CK framework under T1068 Exploitation for Privilege Escalation and T1543 Create or Modify System Process. Systems administrators should prioritize applying kernel updates containing this fix, particularly in environments where USB-based CAN communication interfaces are deployed, and implement network segmentation to limit potential attack vectors targeting these vulnerable devices.