---
id: CVE-2026-74455
title: 'can: peak_usb: validate uCAN receive record lengths'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  can: peak_usb: validate uCAN receive record lengths

  pcan_usb_fd_decode_buf() walks uCAN records packed in one USB
  receive buffer.

  Require each record to contain the f…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0a25e1f4f18566b750ebd3ae995af64e23111e63 <
    276d989cd2dd88e2b7ab2c96fd10c86836b12781
  - >-
    Linux >= 0a25e1f4f18566b750ebd3ae995af64e23111e63 <
    bf9d787b7e1ef59be19b35abca08194772deb97e
  - >-
    Linux >= 0a25e1f4f18566b750ebd3ae995af64e23111e63 <
    89c92a8052698dbbd3652a77c04d02bbd74a3275
  - >-
    Linux >= 0a25e1f4f18566b750ebd3ae995af64e23111e63 <
    6067c878e38d02a3d5c43497347e143f85c9064a
  - >-
    Linux >= 0a25e1f4f18566b750ebd3ae995af64e23111e63 <
    2c8f08f3641a074da40acf05baa5a18ae2739260
  - >-
    Linux >= 0a25e1f4f18566b750ebd3ae995af64e23111e63 <
    2427ef427bdd78d862c7c76597bfd9eda88b81f1
  - >-
    Linux >= 0a25e1f4f18566b750ebd3ae995af64e23111e63 <
    d9c115948c3dd5fcc2d0245cec5eb76c098503c8
  - >-
    Linux >= 0a25e1f4f18566b750ebd3ae995af64e23111e63 <
    93fcab2c6968446316bbb49548848df604d6346f
  - Linux 4.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:57:28.851465Z'
published: '2026-08-15'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:05:46.191Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74455'
references:
  - url: 'https://git.kernel.org/stable/c/276d989cd2dd88e2b7ab2c96fd10c86836b12781'
  - url: 'https://git.kernel.org/stable/c/bf9d787b7e1ef59be19b35abca08194772deb97e'
  - url: 'https://git.kernel.org/stable/c/89c92a8052698dbbd3652a77c04d02bbd74a3275'
  - url: 'https://git.kernel.org/stable/c/6067c878e38d02a3d5c43497347e143f85c9064a'
  - url: 'https://git.kernel.org/stable/c/2c8f08f3641a074da40acf05baa5a18ae2739260'
  - url: 'https://git.kernel.org/stable/c/2427ef427bdd78d862c7c76597bfd9eda88b81f1'
  - url: 'https://git.kernel.org/stable/c/d9c115948c3dd5fcc2d0245cec5eb76c098503c8'
  - url: 'https://git.kernel.org/stable/c/93fcab2c6968446316bbb49548848df604d6346f'
tags:
  - cve.org
epss: 0.00177
epssPercentile: 0.07252
ingestedAt: '2026-11-06T18:00:12.557Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

can: peak_usb: validate uCAN receive record lengths

pcan_usb_fd_decode_buf() walks uCAN records packed in one USB
receive buffer.

Require each record to contain the fixed header for its type, and verify
CAN payload bytes before copying them into the skb.

## Affected

- `Linux >= 0a25e1f4f18566b750ebd3ae995af64e23111e63 < 276d989cd2dd88e2b7ab2c96fd10c86836b12781`
- `Linux >= 0a25e1f4f18566b750ebd3ae995af64e23111e63 < bf9d787b7e1ef59be19b35abca08194772deb97e`
- `Linux >= 0a25e1f4f18566b750ebd3ae995af64e23111e63 < 89c92a8052698dbbd3652a77c04d02bbd74a3275`
- `Linux >= 0a25e1f4f18566b750ebd3ae995af64e23111e63 < 6067c878e38d02a3d5c43497347e143f85c9064a`
- `Linux >= 0a25e1f4f18566b750ebd3ae995af64e23111e63 < 2c8f08f3641a074da40acf05baa5a18ae2739260`
- `Linux >= 0a25e1f4f18566b750ebd3ae995af64e23111e63 < 2427ef427bdd78d862c7c76597bfd9eda88b81f1`
- `Linux >= 0a25e1f4f18566b750ebd3ae995af64e23111e63 < d9c115948c3dd5fcc2d0245cec5eb76c098503c8`
- `Linux >= 0a25e1f4f18566b750ebd3ae995af64e23111e63 < 93fcab2c6968446316bbb49548848df604d6346f`
- `Linux 4.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.