CVE-2026-74456

can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error

In peak_usb_start(), each RX URB transfer buffer is allocated with kmalloc() and the URB is flagged URB_FREE_BUFFER so that the final usb_free_urb() also frees the transfer buffer.

If usb_submit_urb() fails, the error path frees the buffer explicitly with kfree(buf) and then calls usb_free_urb(urb). Because URB_FREE_BUFFER is set, usb_free_urb() -> urb_destroy() frees the same buffer a second time, a double free of the transfer buffer.

BUG: KASAN: double-free in usb_free_urb.part.0+0x91/0xb0 Free of addr ffff8881069ccb80 by task trigger.sh/285

Call Trace: kfree+0x113/0x3c0 usb_free_urb.part.0+0x91/0xb0

Drop the redundant kfree(buf); usb_free_urb() already releases the transfer buffer. This mirrors commit 03819abbeb11 ("net: usb: lan78xx: Fix double free issue with interrupt buffer allocation").

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d to before 914c3b8fa175acf8476ad31cf04e308638e3578eAffected bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d to before 5f2fa5840c34d3a558c57855781be75e03bef752Affected bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d to before b9088d581fff971a7eb1628f8dcc30df6cfef4dcAffected bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d to before 525640b93d3e5f82f4ebea4730f4e0cf799522baAffected bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d to before 4bb3325075138dd5346b71589a959878b564dc0bAffected bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d to before 92d0de80ca2223b9c7da78020155b6cb27824cc0Affected bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d to before dfb17bf04a764462000f11258a7c06aa92d1f261Affected bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d to before 9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9Affected
LinuxLinux	3.4Affected before 3.4Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.151 through 6.6.Not affected 6.12.103 through 6.12.Not affected 6.18.44 through 6.18.Not affected 7.1.8 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d to before 914c3b8fa175acf8476ad31cf04e308638e3578eAffected
bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d to before 5f2fa5840c34d3a558c57855781be75e03bef752Affected
bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d to before b9088d581fff971a7eb1628f8dcc30df6cfef4dcAffected
bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d to before 525640b93d3e5f82f4ebea4730f4e0cf799522baAffected
bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d to before 4bb3325075138dd5346b71589a959878b564dc0bAffected
bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d to before 92d0de80ca2223b9c7da78020155b6cb27824cc0Affected
bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d to before dfb17bf04a764462000f11258a7c06aa92d1f261Affected
bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d to before 9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9Affected

LinuxLinux

3.4Affected
before 3.4Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.151 through 6.6.*Not affected
6.12.103 through 6.12.*Not affected
6.18.44 through 6.18.*Not affected
7.1.8 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.