CVE-2026-74455

A flaw was found in the Linux kernel's peak_usb Controller Area Network (CAN) driver. This vulnerability arises from insufficient validation of uCAN receive record lengths when processing data from a Universal Serial Bus (USB) receive buffer. A local attacker could potentially exploit this by sending specially crafted uCAN records, leading to memory corruption and potentially a denial of service.

This vulnerability is rated as Moderate severity because exploitation requires local access with the capability to supply malformed USB packets, such as via physical device attachment or hypervisor-emulated USB interfaces, and the primary impact is limited to a system denial of service. Standard enterprise Red Hat deployments do not typically utilize CAN bus hardware, and the driver is not loaded by default unless a matching device is connected. Consequently, unprivileged remote attackers cannot trigger this issue in default configurations without physical access or direct USB redirection.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.