CVE-2026-74457

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

can: peak_usb: add bounds check for USB channel index

The channel control index ctrl_idx is derived from rx->len which comes

directly from a device USB payload. The mask 0x0f allows values 0-15, but

the array size of usb_if->dev[] is only 2. Values 2-15 cause heap

out-of-bounds read, eventually causing kernel panic in the IRQ context.

Add bounds checking for ctrl_idx before the array access in both

pcan_usb_pro_handle_canmsg() and pcan_usb_pro_handle_error().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References