CVE-2026-64585

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

can: esd_usb: kill anchored URBs before freeing netdevs

esd_usb_disconnect() frees each CAN netdev with free_candev() inside

its per-netdev loop and only calls unlink_all_urbs(dev) afterwards.

The per-netdev private data (struct esd_usb_net_priv) is embedded in

the net_device allocation returned by alloc_candev(), so once

free_candev() has run, dev->nets[i] points to freed memory.

unlink_all_urbs() then dereferences the freed dev->nets[i] to kill the

per-netdev TX anchor (usb_kill_anchored_urbs(&priv->tx_submitted)),

clear active_tx_jobs, and reset priv->tx_contexts[].

Reorder the teardown so the anchored URBs are killed before the netdevs

are freed, matching other CAN/USB drivers in the same directory such as

ems_usb, usb_8dev and mcba_usb, which unregister, then unlink, then

free: unregister the netdevs first (which stops their TX queues), call

unlink_all_urbs(dev) once, then free the netdevs.

This issue was foun

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References