CVE-2026-74460

can: ems_usb: validate CPC message lengths

N/A

Published: August 15, 2026 at 12:27 PM UTC

Updated: October 3, 2026 at 11:17 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

N/A

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: validate CPC message lengths ems_usb_read_bulk_callback() walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the fields used by the CAN, state, error and overrun handlers.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

2.6.32 ≤ v < 5.10.2712.6.32 ≤ v < 5.15.2162.6.32 ≤ v < 6.1.1832.6.32 ≤ v < 6.12.1032.6.32 ≤ v < 6.18.442.6.32 ≤ v < 6.6.1512.6.32 ≤ v < 7.1.82.6.32 ≤ v < 7.22.6.32702171adeed3607ee9603ec30ce081411e36ae42

Vendor states this is fixed in 02925f51377f2a42a6724f00549167499c9302e5 (fixed)

Vendor states this is fixed in 0b23144c59c126beb4a7761a85a194ae0fe668a5 (fixed)

Vendor states this is fixed in 0b9090717c7e2184e2c427bbcc752f295116ac1d (fixed)

Vendor states this is fixed in 1c380a332e342b7d58c86c4f556cb0823b16a9b8 (fixed)

Vendor states this is fixed in bb3cc8da8a2967c0f8e83d148fc6870b19fa32c6 (fixed)

Vendor states this is fixed in ce8125566b1d0b0f16449407e014addf451804ea (fixed)

Vendor states this is fixed in db5655287d78f00daf98888a520bb8da4d30126d (fixed)

Vendor states this is fixed in df3ac2a672a5284441f120d486acabdd6740fc2a (fixed)

Vendor states this is fixed in 2.6.32 (unaffected)

Vendor states this is fixed in 5.10.271 (unaffected)

Vendor states this is fixed in 5.15.216 (unaffected)

Vendor states this is fixed in 6.1.183 (unaffected)