---
id: CVE-2026-74456
title: >-
  can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB
  submit error
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB
  submit error


  In peak_usb_start(), each RX URB transfer buffer is allocated with kmalloc()

  an…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d <
    914c3b8fa175acf8476ad31cf04e308638e3578e
  - >-
    Linux >= bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d <
    5f2fa5840c34d3a558c57855781be75e03bef752
  - >-
    Linux >= bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d <
    b9088d581fff971a7eb1628f8dcc30df6cfef4dc
  - >-
    Linux >= bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d <
    525640b93d3e5f82f4ebea4730f4e0cf799522ba
  - >-
    Linux >= bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d <
    4bb3325075138dd5346b71589a959878b564dc0b
  - >-
    Linux >= bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d <
    92d0de80ca2223b9c7da78020155b6cb27824cc0
  - >-
    Linux >= bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d <
    dfb17bf04a764462000f11258a7c06aa92d1f261
  - >-
    Linux >= bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d <
    9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9
  - Linux 3.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:56:58.741801Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:46.867Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74456'
references:
  - url: 'https://git.kernel.org/stable/c/914c3b8fa175acf8476ad31cf04e308638e3578e'
  - url: 'https://git.kernel.org/stable/c/5f2fa5840c34d3a558c57855781be75e03bef752'
  - url: 'https://git.kernel.org/stable/c/b9088d581fff971a7eb1628f8dcc30df6cfef4dc'
  - url: 'https://git.kernel.org/stable/c/525640b93d3e5f82f4ebea4730f4e0cf799522ba'
  - url: 'https://git.kernel.org/stable/c/4bb3325075138dd5346b71589a959878b564dc0b'
  - url: 'https://git.kernel.org/stable/c/92d0de80ca2223b9c7da78020155b6cb27824cc0'
  - url: 'https://git.kernel.org/stable/c/dfb17bf04a764462000f11258a7c06aa92d1f261'
  - url: 'https://git.kernel.org/stable/c/9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9'
tags:
  - cve.org
epss: 0.00129
epssPercentile: 0.02273
ingestedAt: '2026-10-16T19:46:24.360Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error

In peak_usb_start(), each RX URB transfer buffer is allocated with kmalloc()
and the URB is flagged URB_FREE_BUFFER so that the final usb_free_urb() also
frees the transfer buffer.

If usb_submit_urb() fails, the error path frees the buffer explicitly with
kfree(buf) and then calls usb_free_urb(urb). Because URB_FREE_BUFFER is set,
usb_free_urb() -> urb_destroy() frees the same buffer a second time, a double
free of the transfer buffer.

  BUG: KASAN: double-free in usb_free_urb.part.0+0x91/0xb0
  Free of addr ffff8881069ccb80 by task trigger.sh/285

  Call Trace:
   kfree+0x113/0x3c0
   usb_free_urb.part.0+0x91/0xb0

Drop the redundant kfree(buf); usb_free_urb() already releases the transfer
buffer. This mirrors commit 03819abbeb11 ("net: usb: lan78xx: Fix double free
issue with interrupt buffer allocation").

## Affected

- `Linux >= bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d < 914c3b8fa175acf8476ad31cf04e308638e3578e`
- `Linux >= bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d < 5f2fa5840c34d3a558c57855781be75e03bef752`
- `Linux >= bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d < b9088d581fff971a7eb1628f8dcc30df6cfef4dc`
- `Linux >= bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d < 525640b93d3e5f82f4ebea4730f4e0cf799522ba`
- `Linux >= bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d < 4bb3325075138dd5346b71589a959878b564dc0b`
- `Linux >= bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d < 92d0de80ca2223b9c7da78020155b6cb27824cc0`
- `Linux >= bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d < dfb17bf04a764462000f11258a7c06aa92d1f261`
- `Linux >= bb4785551f64e18b2c8bb15a3bd2b22f5ebf624d < 9b3d5a6d952c38bbcf07f903cbeadefdb56b9bc9`
- `Linux 3.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.