CVE-2026-74459

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure

es58x_read_bulk_callback() resubmits the RX URB after processing a received

packet. If the resubmit succeeds, the URB remains anchored and will be

handled by the normal RX path or by teardown.

However, if usb_submit_urb() fails, the callback unanchors the URB and then

returns directly. This skips the existing free_urb path, so the coherent

transfer buffer allocated with usb_alloc_coherent() is not released.

Reuse the existing free_urb path after a resubmit failure so that the RX

coherent buffer is freed before leaving the callback.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References