{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74455", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.900Z", "datePublished": "2026-08-15T12:26:58.175Z", "dateUpdated": "2026-08-19T16:36:48.775Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:36:48.775Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: peak_usb: validate uCAN receive record lengths\n\npcan_usb_fd_decode_buf() walks uCAN records packed in one USB\nreceive buffer.\n\nRequire each record to contain the fixed header for its type, and verify\nCAN payload bytes before copying them into the skb."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/can/usb/peak_usb/pcan_usb_fd.c"], "versions": [{"version": "0a25e1f4f18566b750ebd3ae995af64e23111e63", "lessThan": "276d989cd2dd88e2b7ab2c96fd10c86836b12781", "status": "affected", "versionType": "git"}, {"version": "0a25e1f4f18566b750ebd3ae995af64e23111e63", "lessThan": "bf9d787b7e1ef59be19b35abca08194772deb97e", "status": "affected", "versionType": "git"}, {"version": "0a25e1f4f18566b750ebd3ae995af64e23111e63", "lessThan": "89c92a8052698dbbd3652a77c04d02bbd74a3275", "status": "affected", "versionType": "git"}, {"version": "0a25e1f4f18566b750ebd3ae995af64e23111e63", "lessThan": "6067c878e38d02a3d5c43497347e143f85c9064a", "status": "affected", "versionType": "git"}, {"version": "0a25e1f4f18566b750ebd3ae995af64e23111e63", "lessThan": "2c8f08f3641a074da40acf05baa5a18ae2739260", "status": "affected", "versionType": "git"}, {"version": "0a25e1f4f18566b750ebd3ae995af64e23111e63", "lessThan": "2427ef427bdd78d862c7c76597bfd9eda88b81f1", "status": "affected", "versionType": "git"}, {"version": "0a25e1f4f18566b750ebd3ae995af64e23111e63", "lessThan": "d9c115948c3dd5fcc2d0245cec5eb76c098503c8", "status": "affected", "versionType": "git"}, {"version": "0a25e1f4f18566b750ebd3ae995af64e23111e63", "lessThan": "93fcab2c6968446316bbb49548848df604d6346f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/can/usb/peak_usb/pcan_usb_fd.c"], "versions": [{"version": "4.0", "status": "affected"}, {"version": "0", "lessThan": "4.0", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.151", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.103", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.6.151"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.12.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/276d989cd2dd88e2b7ab2c96fd10c86836b12781"}, {"url": "https://git.kernel.org/stable/c/bf9d787b7e1ef59be19b35abca08194772deb97e"}, {"url": "https://git.kernel.org/stable/c/89c92a8052698dbbd3652a77c04d02bbd74a3275"}, {"url": "https://git.kernel.org/stable/c/6067c878e38d02a3d5c43497347e143f85c9064a"}, {"url": "https://git.kernel.org/stable/c/2c8f08f3641a074da40acf05baa5a18ae2739260"}, {"url": "https://git.kernel.org/stable/c/2427ef427bdd78d862c7c76597bfd9eda88b81f1"}, {"url": "https://git.kernel.org/stable/c/d9c115948c3dd5fcc2d0245cec5eb76c098503c8"}, {"url": "https://git.kernel.org/stable/c/93fcab2c6968446316bbb49548848df604d6346f"}], "title": "can: peak_usb: validate uCAN receive record lengths", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/can/usb/peak_usb/pcan_usb_fd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "276d989cd2dd88e2b7ab2c96fd10c86836b12781", "status": "affected", "version": "0a25e1f4f18566b750ebd3ae995af64e23111e63", "versionType": "git"}, {"lessThan": "bf9d787b7e1ef59be19b35abca08194772deb97e", "status": "affected", "version": "0a25e1f4f18566b750ebd3ae995af64e23111e63", "versionType": "git"}, {"lessThan": "89c92a8052698dbbd3652a77c04d02bbd74a3275", "status": "affected", "version": "0a25e1f4f18566b750ebd3ae995af64e23111e63", "versionType": "git"}, {"lessThan": "6067c878e38d02a3d5c43497347e143f85c9064a", "status": "affected", "version": "0a25e1f4f18566b750ebd3ae995af64e23111e63", "versionType": "git"}, {"lessThan": "2c8f08f3641a074da40acf05baa5a18ae2739260", "status": "affected", "version": "0a25e1f4f18566b750ebd3ae995af64e23111e63", "versionType": "git"}, {"lessThan": "2427ef427bdd78d862c7c76597bfd9eda88b81f1", "status": "affected", "version": "0a25e1f4f18566b750ebd3ae995af64e23111e63", "versionType": "git"}, {"lessThan": "d9c115948c3dd5fcc2d0245cec5eb76c098503c8", "status": "affected", "version": "0a25e1f4f18566b750ebd3ae995af64e23111e63", "versionType": "git"}, {"lessThan": "93fcab2c6968446316bbb49548848df604d6346f", "status": "affected", "version": "0a25e1f4f18566b750ebd3ae995af64e23111e63", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/can/usb/peak_usb/pcan_usb_fd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.0"}, {"lessThan": "4.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.151", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.103", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: peak_usb: validate uCAN receive record lengths\n\npcan_usb_fd_decode_buf() walks uCAN records packed in one USB\nreceive buffer.\n\nRequire each record to contain the fixed header for its type, and verify\nCAN payload bytes before copying them into the skb."}], "id": "CVE-2026-74455", "lastModified": "2026-08-19T17:21:02.253", "metrics": {}, "published": "2026-08-15T13:17:50.120", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2427ef427bdd78d862c7c76597bfd9eda88b81f1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/276d989cd2dd88e2b7ab2c96fd10c86836b12781"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2c8f08f3641a074da40acf05baa5a18ae2739260"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6067c878e38d02a3d5c43497347e143f85c9064a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/89c92a8052698dbbd3652a77c04d02bbd74a3275"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/93fcab2c6968446316bbb49548848df604d6346f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bf9d787b7e1ef59be19b35abca08194772deb97e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d9c115948c3dd5fcc2d0245cec5eb76c098503c8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: can: peak_usb: validate uCAN receive record lengths", "id": "2517036", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517036"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ncan: peak_usb: validate uCAN receive record lengths\npcan_usb_fd_decode_buf() walks uCAN records packed in one USB\nreceive buffer.\nRequire each record to contain the fixed header for its type, and verify\nCAN payload bytes before copying them into the skb.", "A flaw was found in the Linux kernel's `peak_usb` Controller Area Network (CAN) driver. This vulnerability arises from insufficient validation of uCAN receive record lengths when processing data from a Universal Serial Bus (USB) receive buffer. A local attacker could potentially exploit this by sending specially crafted uCAN records, leading to memory corruption and potentially a denial of service."], "name": "CVE-2026-74455", "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74455\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74455\nhttps://lore.kernel.org/linux-cve-announce/2026081531-CVE-2026-74455-b371@gregkh/T"], "threat_severity": "Moderate"}