Bug 2517036 (CVE-2026-74455)

Summary:	CVE-2026-74455 kernel: can: peak_usb: validate uCAN receive record lengths
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's `peak_usb` Controller Area Network (CAN) driver. This vulnerability arises from insufficient validation of uCAN receive record lengths when processing data from a Universal Serial Bus (USB) receive buffer. A local attacker could potentially exploit this by sending specially crafted uCAN records, leading to memory corruption and potentially a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 12:46:11 UTC

In the Linux kernel, the following vulnerability has been resolved:

can: peak_usb: validate uCAN receive record lengths

pcan_usb_fd_decode_buf() walks uCAN records packed in one USB
receive buffer.

Require each record to contain the fixed header for its type, and verify
CAN payload bytes before copying them into the skb.

Comment 1 Mauro Matteo Cascella 2026-08-19 18:31:28 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081531-CVE-2026-74455-b371@gregkh/T