---
id: CVE-2026-64585
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  can: esd_usb: kill anchored URBs before freeing netdevs

  esd_usb_disconnect() frees each CAN netdev with free_candev() inside
  its per-netdev loop and only calls unlink_…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  can: esd_usb: kill anchored URBs before freeing netdevs

  esd_usb_disconnect() frees each CAN netdev with free_candev() inside
  its per-netdev loop and only calls unlink_…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
published: '2026-08-06'
updated: '2026-08-08'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64585'
references:
  - url: 'https://git.kernel.org/stable/c/5832c55b3c824ba2fe9c36ac3c411baddcce053e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/765ba1c91823a296447528791b89a6504947fd5c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a02e1d8f191324583599544d54e59e6a2b74bb0e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a3314f10369df70925140f59bbe069718f65a0b9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/aa1d005927db38af783c1a4a8a00a39e0229ab2d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c43122fef328a70045fe7621c06de6b2b8e19264'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.0012
epssPercentile: 0.02121
ingestedAt: '2026-08-08T21:30:13.149Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

can: esd_usb: kill anchored URBs before freeing netdevs

esd_usb_disconnect() frees each CAN netdev with free_candev() inside
its per-netdev loop and only calls unlink_all_urbs(dev) afterwards.
The per-netdev private data (struct esd_usb_net_priv) is embedded in
the net_device allocation returned by alloc_candev(), so once
free_candev() has run, dev->nets[i] points to freed memory.
unlink_all_urbs() then dereferences the freed dev->nets[i] to kill the
per-netdev TX anchor (usb_kill_anchored_urbs(&priv->tx_submitted)),
clear active_tx_jobs, and reset priv->tx_contexts[].

Reorder the teardown so the anchored URBs are killed before the netdevs
are freed, matching other CAN/USB drivers in the same directory such as
ems_usb, usb_8dev and mcba_usb, which unregister, then unlink, then
free: unregister the netdevs first (which stops their TX queues), call
unlink_all_urbs(dev) once, then free the netdevs.

This issue was found by an in-house static analysis tool.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.