CVE-2026-64585

can: esd_usb: kill anchored URBs before freeing netdevs

State: Published
Severity: 7.8 High
Published: Aug 6, 2026
Updated: Aug 23, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

can: esd_usb: kill anchored URBs before freeing netdevs

esd_usb_disconnect() frees each CAN netdev with free_candev() inside its per-netdev loop and only calls unlink_all_urbs(dev) afterwards. The per-netdev private data (struct esd_usb_net_priv) is embedded in the net_device allocation returned by alloc_candev(), so once free_candev() has run, dev->nets[i] points to freed memory. unlink_all_urbs() then dereferences the freed dev->nets[i] to kill the per-netdev TX anchor (usb_kill_anchored_urbs(&priv->tx_submitted)), clear active_tx_jobs, and reset priv->tx_contexts[].

Reorder the teardown so the anchored URBs are killed before the netdevs are freed, matching other CAN/USB drivers in the same directory such as ems_usb, usb_8dev and mcba_usb, which unregister, then unlink, then free: unregister the netdevs first (which stops their TX queues), call unlink_all_urbs(dev) once, then free the netdevs.

This issue was found by an in-house static analysis tool.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	96d8e90382dc336b5de401164597edfdc2e8d9f1 to before d12f6add48f2da15c8c8281961d3faad804c76cfAffected 96d8e90382dc336b5de401164597edfdc2e8d9f1 to before aa1d005927db38af783c1a4a8a00a39e0229ab2dAffected 96d8e90382dc336b5de401164597edfdc2e8d9f1 to before a02e1d8f191324583599544d54e59e6a2b74bb0eAffected 96d8e90382dc336b5de401164597edfdc2e8d9f1 to before a3314f10369df70925140f59bbe069718f65a0b9Affected 96d8e90382dc336b5de401164597edfdc2e8d9f1 to before 765ba1c91823a296447528791b89a6504947fd5cAffected 96d8e90382dc336b5de401164597edfdc2e8d9f1 to before 5832c55b3c824ba2fe9c36ac3c411baddcce053eAffected 96d8e90382dc336b5de401164597edfdc2e8d9f1 to before c43122fef328a70045fe7621c06de6b2b8e19264Affected
LinuxLinux	2.6.36Affected before 2.6.36Not affected 5.15.217 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

96d8e90382dc336b5de401164597edfdc2e8d9f1 to before d12f6add48f2da15c8c8281961d3faad804c76cfAffected
96d8e90382dc336b5de401164597edfdc2e8d9f1 to before aa1d005927db38af783c1a4a8a00a39e0229ab2dAffected
96d8e90382dc336b5de401164597edfdc2e8d9f1 to before a02e1d8f191324583599544d54e59e6a2b74bb0eAffected
96d8e90382dc336b5de401164597edfdc2e8d9f1 to before a3314f10369df70925140f59bbe069718f65a0b9Affected
96d8e90382dc336b5de401164597edfdc2e8d9f1 to before 765ba1c91823a296447528791b89a6504947fd5cAffected
96d8e90382dc336b5de401164597edfdc2e8d9f1 to before 5832c55b3c824ba2fe9c36ac3c411baddcce053eAffected
96d8e90382dc336b5de401164597edfdc2e8d9f1 to before c43122fef328a70045fe7621c06de6b2b8e19264Affected

LinuxLinux

2.6.36Affected
before 2.6.36Not affected
5.15.217 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.