CVE-2026-74458None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents The wait and bulk receive paths walk variable-length commands from a USB buffer. A …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
In the Linux kernel, the following vulnerability has been resolved:
can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
The wait and bulk receive paths walk variable-length commands from a USB buffer. A nonzero command shorter than CMD_HEADER_LEN can still be dispatched, and the wait path copies a matching command into a fixed caller-owned struct kvaser_cmd using the device-provided length.
Reject nonzero commands that do not contain the fixed header or that extend beyond the current USB buffer item. In the wait path, also reject a matching command that exceeds the destination before copying it.
Linux >= 080f40a6fa28dab299da7a652e444b1e2d9231e7 < c00ec53d7dec08134e97071850cc00ef000c5b77Linux >= 080f40a6fa28dab299da7a652e444b1e2d9231e7 < d9e91672526ffa279709b15490118aea1bdee714Linux >= 080f40a6fa28dab299da7a652e444b1e2d9231e7 < 72f96c2942f11a0ae8663adcb3d9ee986e07d4faLinux >= 080f40a6fa28dab299da7a652e444b1e2d9231e7 < 695aea154bb2d453e6daada1510972fafd075285Linux >= 080f40a6fa28dab299da7a652e444b1e2d9231e7 < 3d0897ec623e422695d70d80ae456f89476c5328Linux >= 080f40a6fa28dab299da7a652e444b1e2d9231e7 < 185cb1fa38142a3cbf223dd8b3abb24217f330d3Linux >= 080f40a6fa28dab299da7a652e444b1e2d9231e7 < 21f0465fd86d77794aaed8e05f833634f68d178dLinux >= 080f40a6fa28dab299da7a652e444b1e2d9231e7 < 0293dd153f9dbc1ddf5dacdccc76b363bce4a8eeLinux 3.8Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses