CVE-2026-74458

can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents

State: Published
Severity: Not scored
Published: Aug 15, 2026
Updated: Aug 19, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents

The wait and bulk receive paths walk variable-length commands from a USB buffer. A nonzero command shorter than CMD_HEADER_LEN can still be dispatched, and the wait path copies a matching command into a fixed caller-owned struct kvaser_cmd using the device-provided length.

Reject nonzero commands that do not contain the fixed header or that extend beyond the current USB buffer item. In the wait path, also reject a matching command that exceeds the destination before copying it.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	080f40a6fa28dab299da7a652e444b1e2d9231e7 to before c00ec53d7dec08134e97071850cc00ef000c5b77Affected 080f40a6fa28dab299da7a652e444b1e2d9231e7 to before d9e91672526ffa279709b15490118aea1bdee714Affected 080f40a6fa28dab299da7a652e444b1e2d9231e7 to before 72f96c2942f11a0ae8663adcb3d9ee986e07d4faAffected 080f40a6fa28dab299da7a652e444b1e2d9231e7 to before 695aea154bb2d453e6daada1510972fafd075285Affected 080f40a6fa28dab299da7a652e444b1e2d9231e7 to before 3d0897ec623e422695d70d80ae456f89476c5328Affected 080f40a6fa28dab299da7a652e444b1e2d9231e7 to before 185cb1fa38142a3cbf223dd8b3abb24217f330d3Affected 080f40a6fa28dab299da7a652e444b1e2d9231e7 to before 21f0465fd86d77794aaed8e05f833634f68d178dAffected 080f40a6fa28dab299da7a652e444b1e2d9231e7 to before 0293dd153f9dbc1ddf5dacdccc76b363bce4a8eeAffected
LinuxLinux	3.8Affected before 3.8Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.151 through 6.6.Not affected 6.12.103 through 6.12.Not affected 6.18.44 through 6.18.Not affected 7.1.8 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

080f40a6fa28dab299da7a652e444b1e2d9231e7 to before c00ec53d7dec08134e97071850cc00ef000c5b77Affected
080f40a6fa28dab299da7a652e444b1e2d9231e7 to before d9e91672526ffa279709b15490118aea1bdee714Affected
080f40a6fa28dab299da7a652e444b1e2d9231e7 to before 72f96c2942f11a0ae8663adcb3d9ee986e07d4faAffected
080f40a6fa28dab299da7a652e444b1e2d9231e7 to before 695aea154bb2d453e6daada1510972fafd075285Affected
080f40a6fa28dab299da7a652e444b1e2d9231e7 to before 3d0897ec623e422695d70d80ae456f89476c5328Affected
080f40a6fa28dab299da7a652e444b1e2d9231e7 to before 185cb1fa38142a3cbf223dd8b3abb24217f330d3Affected
080f40a6fa28dab299da7a652e444b1e2d9231e7 to before 21f0465fd86d77794aaed8e05f833634f68d178dAffected
080f40a6fa28dab299da7a652e444b1e2d9231e7 to before 0293dd153f9dbc1ddf5dacdccc76b363bce4a8eeAffected

LinuxLinux

3.8Affected
before 3.8Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.151 through 6.6.*Not affected
6.12.103 through 6.12.*Not affected
6.18.44 through 6.18.*Not affected
7.1.8 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.