CVE-2026-74456

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error

In peak_usb_start(), each RX URB transfer buffer is allocated with kmalloc()

and the URB is flagged URB_FREE_BUFFER so that the final usb_free_urb() also

frees the transfer buffer.

If usb_submit_urb() fails, the error path frees the buffer explicitly with

kfree(buf) and then calls usb_free_urb(urb). Because URB_FREE_BUFFER is set,

usb_free_urb() -> urb_destroy() frees the same buffer a second time, a double

free of the transfer buffer.

BUG: KASAN: double-free in usb_free_urb.part.0+0x91/0xb0

Free of addr ffff8881069ccb80 by task trigger.sh/285

Call Trace:

kfree+0x113/0x3c0

usb_free_urb.part.0+0x91/0xb0

Drop the redundant kfree(buf); usb_free_urb() already releases the transfer

buffer. This mirrors commit 03819abbeb11 ("net: usb: lan78xx: Fix double free

issue with interrupt buffer allocation").

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References