CVE-2026-74458

A flaw was found in the Kvaser USB CAN driver (kvaser_usb_leaf) in the Linux kernel. This vulnerability occurs due to insufficient validation of received command lengths from a USB buffer. A malicious or malformed command shorter than the expected header length, or one that exceeds the destination buffer, can be processed. This could lead to a buffer overflow, potentially causing a denial of service or other system instability.

A malicious or faulty Kvaser USB/CAN device can provide a variable length command with an invalid length field in the USB receive buffer. In kvaser_usb_leaf_wait_cmd(), a matching command was copied into a fixed struct kvaser_cmd using the device provided length, so an oversized command can cause an out-of-bounds write and corrupt kernel memory. For the CVSS the PR:N because no host privileges are required once the attacker can present or control the USB device. The issue is not network reachable and requires physical or equivalent USB device access. Impact is at least denial of service via kernel crash and may include privilege escalation because the primitive is a kernel memory overwrite from device controlled data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.