{"id":"CVE-2026-64585","summary":"can: esd_usb: kill anchored URBs before freeing netdevs","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: esd_usb: kill anchored URBs before freeing netdevs\n\nesd_usb_disconnect() frees each CAN netdev with free_candev() inside\nits per-netdev loop and only calls unlink_all_urbs(dev) afterwards.\nThe per-netdev private data (struct esd_usb_net_priv) is embedded in\nthe net_device allocation returned by alloc_candev(), so once\nfree_candev() has run, dev-\u003enets[i] points to freed memory.\nunlink_all_urbs() then dereferences the freed dev-\u003enets[i] to kill the\nper-netdev TX anchor (usb_kill_anchored_urbs(&priv-\u003etx_submitted)),\nclear active_tx_jobs, and reset priv-\u003etx_contexts[].\n\nReorder the teardown so the anchored URBs are killed before the netdevs\nare freed, matching other CAN/USB drivers in the same directory such as\nems_usb, usb_8dev and mcba_usb, which unregister, then unlink, then\nfree: unregister the netdevs first (which stops their TX queues), call\nunlink_all_urbs(dev) once, then free the netdevs.\n\nThis issue was found by an in-house static analysis tool.","modified":"2026-08-25T03:51:35.576629116Z","published":"2026-08-06T07:06:26.556Z","related":["openSUSE-SU-2026:11476-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64585.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/5832c55b3c824ba2fe9c36ac3c411baddcce053e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/765ba1c91823a296447528791b89a6504947fd5c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a02e1d8f191324583599544d54e59e6a2b74bb0e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a3314f10369df70925140f59bbe069718f65a0b9"},{"type":"WEB","url":"https://git.kernel.org/stable/c/aa1d005927db38af783c1a4a8a00a39e0229ab2d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c43122fef328a70045fe7621c06de6b2b8e19264"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d12f6add48f2da15c8c8281961d3faad804c76cf"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64585.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64585"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"96d8e90382dc336b5de401164597edfdc2e8d9f1"},{"fixed":"d12f6add48f2da15c8c8281961d3faad804c76cf"},{"fixed":"aa1d005927db38af783c1a4a8a00a39e0229ab2d"},{"fixed":"a02e1d8f191324583599544d54e59e6a2b74bb0e"},{"fixed":"a3314f10369df70925140f59bbe069718f65a0b9"},{"fixed":"765ba1c91823a296447528791b89a6504947fd5c"},{"fixed":"5832c55b3c824ba2fe9c36ac3c411baddcce053e"},{"fixed":"c43122fef328a70045fe7621c06de6b2b8e19264"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64585.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.36"},{"fixed":"5.15.217"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.178"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.145"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.97"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.40"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64585.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}