CVE-2026-64585 is a vulnerability in Linux Kernel
Published on August 6, 2026
can: esd_usb: kill anchored URBs before freeing netdevs
In the Linux kernel, the following vulnerability has been resolved:
can: esd_usb: kill anchored URBs before freeing netdevs
esd_usb_disconnect() frees each CAN netdev with free_candev() inside
its per-netdev loop and only calls unlink_all_urbs(dev) afterwards.
The per-netdev private data (struct esd_usb_net_priv) is embedded in
the net_device allocation returned by alloc_candev(), so once
free_candev() has run, dev->nets[i] points to freed memory.
unlink_all_urbs() then dereferences the freed dev->nets[i] to kill the
per-netdev TX anchor (usb_kill_anchored_urbs(&priv->tx_submitted)),
clear active_tx_jobs, and reset priv->tx_contexts[].
Reorder the teardown so the anchored URBs are killed before the netdevs
are freed, matching other CAN/USB drivers in the same directory such as
ems_usb, usb_8dev and mcba_usb, which unregister, then unlink, then
free: unregister the netdevs first (which stops their TX queues), call
unlink_all_urbs(dev) once, then free the netdevs.
This issue was found by an in-house static analysis tool.
Products Associated with CVE-2026-64585
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 96d8e90382dc336b5de401164597edfdc2e8d9f1 and below aa1d005927db38af783c1a4a8a00a39e0229ab2d is affected.
- Version 96d8e90382dc336b5de401164597edfdc2e8d9f1 and below a02e1d8f191324583599544d54e59e6a2b74bb0e is affected.
- Version 96d8e90382dc336b5de401164597edfdc2e8d9f1 and below a3314f10369df70925140f59bbe069718f65a0b9 is affected.
- Version 96d8e90382dc336b5de401164597edfdc2e8d9f1 and below 765ba1c91823a296447528791b89a6504947fd5c is affected.
- Version 96d8e90382dc336b5de401164597edfdc2e8d9f1 and below 5832c55b3c824ba2fe9c36ac3c411baddcce053e is affected.
- Version 96d8e90382dc336b5de401164597edfdc2e8d9f1 and below c43122fef328a70045fe7621c06de6b2b8e19264 is affected.
- Version 2.6.36 is affected.
- Before 2.6.36 is unaffected.
- Version 6.1.178, <= 6.1.* is unaffected.
- Version 6.6.145, <= 6.6.* is unaffected.
- Version 6.12.97, <= 6.12.* is unaffected.
- Version 6.18.40, <= 6.18.* is unaffected.
- Version 7.1.5, <= 7.1.* is unaffected.
- Version 7.2-rc4, <= * is unaffected.