https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 22:57:50 +0000 https://vulnerability.circl.lu/vuln/cve-2026-64585 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>can: esd_usb: kill anchored URBs before freeing netdevs</p> <p>esd_usb_disconnect() frees each CAN netdev with free_candev() inside its per-netdev loop and only calls unlink_all_urbs(dev) afterwards. The per-netdev private data (struct esd_usb_net_priv) is embedded in the net_device allocation returned by alloc_candev(), so once free_candev() has run, dev-&gt;nets[i] points to freed memory. unlink_all_urbs() then dereferences the freed dev-&gt;nets[i] to kill the per-netdev TX anchor (usb_kill_anchored_urbs(&amp;priv-&gt;tx_submitted)), clear active_tx_jobs, and reset priv-&gt;tx_contexts[].</p> <p>Reorder the teardown so the anchored URBs are killed before the netdevs are freed, matching other CAN/USB drivers in the same directory such as ems_usb, usb_8dev and mcba_usb, which unregister, then unlink, then free: unregister the netdevs first (which stops their TX queues), call unlink_all_urbs(dev) once, then free the netdevs.</p> <p>This issue was found by an in-house static analysis tool.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>can: esd_usb: kill anchored URBs before freeing netdevs</p> <p>esd_usb_disconnect() frees each CAN netdev with free_candev() inside its per-netdev loop and only calls unlink_all_urbs(dev) afterwards. The per-netdev private data (struct esd_usb_net_priv) is embedded in the net_device allocation returned by alloc_candev(), so once free_candev() has run, dev-&gt;nets[i] points to freed memory. unlink_all_urbs() then dereferences the freed dev-&gt;nets[i] to kill the per-netdev TX anchor (usb_kill_anchored_urbs(&amp;priv-&gt;tx_submitted)), clear active_tx_jobs, and reset priv-&gt;tx_contexts[].</p> <p>Reorder the teardown so the anchored URBs are killed before the netdevs are freed, matching other CAN/USB drivers in the same directory such as ems_usb, usb_8dev and mcba_usb, which unregister, then unlink, then free: unregister the netdevs first (which stops their TX queues), call unlink_all_urbs(dev) once, then free the netdevs.</p> <p>This issue was found by an in-house static analysis tool.</p> https://vulnerability.circl.lu/vuln/cve-2026-64585