CVE-2026-74456

A flaw was found in the Linux kernel's Controller Area Network (CAN) Universal Serial Bus (USB) driver. This vulnerability, a double free, occurs when a USB request block (URB) submission fails, causing the system to attempt to release the same memory twice. This could allow a local attacker to potentially crash the system, leading to a denial of service, or in some scenarios, execute arbitrary code with elevated privileges.

A double-free can occur in the PEAK USB CAN driver error path when peak_usb_start() allocates an RX transfer buffer and sets URB_FREE_BUFFER on the URB. If usb_submit_urb() fails, the old error path frees the buffer with kfree(buf) and then calls usb_free_urb(), which frees the same transfer buffer again because URB_FREE_BUFFER is set. This is a local memory corruption issue and can at least crash the kernel. For the CVSS the PR:L is used for the paranoid score because a reduced capability root, container root, service account, or delegated CAP_NET_ADMIN process may be able to start or reset the CAN network interface without being full host root. The issue is not network reachable in the IP sense and requires local control over the affected USB CAN device or its network interface. Impact is at least local denial of service via kernel crash and in the worst case may allow confidentiality or integrity impact due to double-free memory corruption, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.