{"id":"CVE-2026-64585","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-64585","summary":"can: esd_usb: kill anchored URBs before freeing netdevs","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: esd_usb: kill anchored URBs before freeing netdevs\n\nesd_usb_disconnect() frees each CAN netdev with free_candev() inside\nits per-netdev loop and only calls unlink_all_urbs(dev) afterwards.\nThe per-netdev private data (struct esd_usb_net_priv) is embedded in\nthe net_device allocation returned by alloc_candev(), so once\nfree_candev() has run, dev->nets[i] points to freed memory.\nunlink_all_urbs() then dereferences the freed dev->nets[i] to kill the\nper-netdev TX anchor (usb_kill_anchored_urbs(&priv->tx_submitted)),\nclear active_tx_jobs, and reset priv->tx_contexts[].\n\nReorder the teardown so the anchored URBs are killed before the netdevs\nare freed, matching other CAN/USB drivers in the same directory such as\nems_usb, usb_8dev and mcba_usb, which unregister, then unlink, then\nfree: unregister the netdevs first (which stops their TX queues), call\nunlink_all_urbs(dev) once, then free the netdevs.\n\nThis issue was found by an in-house static analysis tool.","published":"2026-08-06T07:06:26.556Z","modified":"2026-08-08T03:32:18.690306066Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"6.1.178"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/5832c55b3c824ba2fe9c36ac3c411baddcce053e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/765ba1c91823a296447528791b89a6504947fd5c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a02e1d8f191324583599544d54e59e6a2b74bb0e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a3314f10369df70925140f59bbe069718f65a0b9"},{"type":"WEB","url":"https://git.kernel.org/stable/c/aa1d005927db38af783c1a4a8a00a39e0229ab2d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c43122fef328a70045fe7621c06de6b2b8e19264"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64585.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64585"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-08T03:32:18.690306066Z"}}