---
id: CVE-2026-74457
title: 'can: peak_usb: add bounds check for USB channel index'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  can: peak_usb: add bounds check for USB channel index

  The channel control index ctrl_idx is derived from rx->len which comes
  directly from a device USB payload. The ma…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d8a199355f8f8a0797c00d98788d7282c9ea38bd <
    18b1a868a2cda66fb438007ba47ce5f2484db381
  - >-
    Linux >= d8a199355f8f8a0797c00d98788d7282c9ea38bd <
    0c9268457bd6e4058fe55b4db01b16661c2eacf5
  - >-
    Linux >= d8a199355f8f8a0797c00d98788d7282c9ea38bd <
    94fb6fe83ce152532b11b36730b30f3dc0c94217
  - >-
    Linux >= d8a199355f8f8a0797c00d98788d7282c9ea38bd <
    825c903ca3c98cd0cf0e3de8ab8f2604a5339b3f
  - >-
    Linux >= d8a199355f8f8a0797c00d98788d7282c9ea38bd <
    f97b7e5e1cdaae15cd95b3a360028c7929664969
  - >-
    Linux >= d8a199355f8f8a0797c00d98788d7282c9ea38bd <
    1acab790b7cecd4e144d1d18bdfe549e282f6b0b
  - >-
    Linux >= d8a199355f8f8a0797c00d98788d7282c9ea38bd <
    0149fdb50a30944827acf9600a2cc44de0325a7f
  - >-
    Linux >= d8a199355f8f8a0797c00d98788d7282c9ea38bd <
    39132f166ca8ce00ae60d8a9068e06a60943cc4b
  - Linux 3.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:57:34.054419Z'
published: '2026-08-15'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:05:46.411Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74457'
references:
  - url: 'https://git.kernel.org/stable/c/18b1a868a2cda66fb438007ba47ce5f2484db381'
  - url: 'https://git.kernel.org/stable/c/0c9268457bd6e4058fe55b4db01b16661c2eacf5'
  - url: 'https://git.kernel.org/stable/c/94fb6fe83ce152532b11b36730b30f3dc0c94217'
  - url: 'https://git.kernel.org/stable/c/825c903ca3c98cd0cf0e3de8ab8f2604a5339b3f'
  - url: 'https://git.kernel.org/stable/c/f97b7e5e1cdaae15cd95b3a360028c7929664969'
  - url: 'https://git.kernel.org/stable/c/1acab790b7cecd4e144d1d18bdfe549e282f6b0b'
  - url: 'https://git.kernel.org/stable/c/0149fdb50a30944827acf9600a2cc44de0325a7f'
  - url: 'https://git.kernel.org/stable/c/39132f166ca8ce00ae60d8a9068e06a60943cc4b'
tags:
  - cve.org
epss: 0.00177
epssPercentile: 0.07253
ingestedAt: '2026-11-06T18:00:12.557Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

can: peak_usb: add bounds check for USB channel index

The channel control index ctrl_idx is derived from rx->len which comes
directly from a device USB payload. The mask 0x0f allows values 0-15, but
the array size of usb_if->dev[] is only 2. Values 2-15 cause heap
out-of-bounds read, eventually causing kernel panic in the IRQ context.

Add bounds checking for ctrl_idx before the array access in both
pcan_usb_pro_handle_canmsg() and pcan_usb_pro_handle_error().

## Affected

- `Linux >= d8a199355f8f8a0797c00d98788d7282c9ea38bd < 18b1a868a2cda66fb438007ba47ce5f2484db381`
- `Linux >= d8a199355f8f8a0797c00d98788d7282c9ea38bd < 0c9268457bd6e4058fe55b4db01b16661c2eacf5`
- `Linux >= d8a199355f8f8a0797c00d98788d7282c9ea38bd < 94fb6fe83ce152532b11b36730b30f3dc0c94217`
- `Linux >= d8a199355f8f8a0797c00d98788d7282c9ea38bd < 825c903ca3c98cd0cf0e3de8ab8f2604a5339b3f`
- `Linux >= d8a199355f8f8a0797c00d98788d7282c9ea38bd < f97b7e5e1cdaae15cd95b3a360028c7929664969`
- `Linux >= d8a199355f8f8a0797c00d98788d7282c9ea38bd < 1acab790b7cecd4e144d1d18bdfe549e282f6b0b`
- `Linux >= d8a199355f8f8a0797c00d98788d7282c9ea38bd < 0149fdb50a30944827acf9600a2cc44de0325a7f`
- `Linux >= d8a199355f8f8a0797c00d98788d7282c9ea38bd < 39132f166ca8ce00ae60d8a9068e06a60943cc4b`
- `Linux 3.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.