Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-74460

can: ems_usb: validate CPC message lengths

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.271, 5.15.216, 6.1.183, 6.6.151, 6.12.103, and 2 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: validate CPC message lengths ems_usb_read_bulk_callback() walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the fields used by the CAN, state, error and overrun handlers.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 702171adeed3607ee9603ec30ce081411e36ae42 · fixed in 1c380a332e342b7d58c86c4f556cb0823b16a9b8; From 702171adeed3607ee9603ec30ce081411e36ae42 · fixed in bb3cc8da8a2967c0f8e83d148fc6870b19fa32c6; From 702171adeed3607ee9603ec30ce081411e36ae42 · fixed in db5655287d78f00daf98888a520bb8da4d30126d; From 702171adeed3607ee9603ec30ce081411e36ae42 · fixed in ce8125566b1d0b0f16449407e014addf451804ea; From 702171adeed3607ee9603ec30ce081411e36ae42 · fixed in 0b9090717c7e2184e2c427bbcc752f295116ac1d; From 702171adeed3607ee9603ec30ce081411e36ae42 · fixed in 0b23144c59c126beb4a7761a85a194ae0fe668a5; From 702171adeed3607ee9603ec30ce081411e36ae42 · fixed in df3ac2a672a5284441f120d486acabdd6740fc2a; From 702171adeed3607ee9603ec30ce081411e36ae42 · fixed in 02925f51377f2a42a6724f00549167499c9302e5

  • Linux Linux

    2.6.32

  • KernelLinux

    From 2.6.32 · fixed in 5.10.271; From 5.11.0 · fixed in 5.15.216; From 5.16.0 · fixed in 6.1.183; From 6.2.0 · fixed in 6.6.151; From 6.7.0 · fixed in 6.12.103; From 6.13.0 · fixed in 6.18.44; From 6.19.0 · fixed in 7.1.8

References 8

git.kernel.org