---
cve: "CVE-2026-74458"
severity: "LOW"
cvss: 3.1
epss: "18%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-08-15 13:17:50"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-02T14:02:44+02:00"
---

# CVE-2026-74458

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents

The wait and bulk receive paths walk variable-length commands from a
USB buffer. A nonzero command shorter than CMD_HEADER_LEN can still be
dispatched, and the wait path copies a matching command into a fixed
caller-owned struct kvaser_cmd using the device-provided length.

Reject nonzero commands that do not contain the fixed header or that
extend beyond the current USB buffer item. In the wait path, also reject
a matching command that exceeds the destination before copying it.

## Patch verfügbar (OSV)

- Kernel ≥ 5.10.265
- Kernel ≥ 5.15.216
- Kernel ≥ 6.1.183
- Kernel ≥ 6.6.151
- Kernel ≥ 6.12.103
- Kernel ≥ 6.18.44
- Kernel ≥ 7.1.8

## Referenzen

- <https://git.kernel.org/stable/c/c00ec53d7dec08134e97071850cc00ef000c5b77>
- <https://git.kernel.org/stable/c/d9e91672526ffa279709b15490118aea1bdee714>
- <https://git.kernel.org/stable/c/72f96c2942f11a0ae8663adcb3d9ee986e07d4fa>
- <https://git.kernel.org/stable/c/695aea154bb2d453e6daada1510972fafd075285>
- <https://git.kernel.org/stable/c/3d0897ec623e422695d70d80ae456f89476c5328>
- <https://git.kernel.org/stable/c/185cb1fa38142a3cbf223dd8b3abb24217f330d3>
- <https://git.kernel.org/stable/c/21f0465fd86d77794aaed8e05f833634f68d178d>
- <https://git.kernel.org/stable/c/0293dd153f9dbc1ddf5dacdccc76b363bce4a8ee>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-74458) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_