CVE-2026-74460

Summary

In the Linux kernel, the following vulnerability has been resolved:

can: ems_usb: validate CPC message lengths

ems_usb_read_bulk_callback() walks CPC messages packed in one USB receive buffer.

Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the fields used by the CAN, state, error and overrun handlers.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux702171adeed3607ee9603ec30ce081411e36ae42 < ce8125566b1d0b0f16449407e014addf451804eaaffected
LinuxLinux702171adeed3607ee9603ec30ce081411e36ae42 < 0b9090717c7e2184e2c427bbcc752f295116ac1daffected
LinuxLinux702171adeed3607ee9603ec30ce081411e36ae42 < 0b23144c59c126beb4a7761a85a194ae0fe668a5affected
LinuxLinux702171adeed3607ee9603ec30ce081411e36ae42 < df3ac2a672a5284441f120d486acabdd6740fc2aaffected
LinuxLinux702171adeed3607ee9603ec30ce081411e36ae42 < 02925f51377f2a42a6724f00549167499c9302e5affected
LinuxLinux2.6.32affected
LinuxLinux0 < 2.6.32unaffected
LinuxLinux6.6.151 <= 6.6.*unaffected
LinuxLinux6.12.103 <= 6.12.*unaffected
LinuxLinux6.18.44 <= 6.18.*unaffected
LinuxLinux7.1.8 <= 7.1.*unaffected
LinuxLinux7.2-rc6 <= *unaffected

Weaknesses

References