Skip to main content

Linux Kernel CVE-2026-64585

| EUVDEUVD-2026-53772 HIGH
2026-08-06 Linux GHSA-88mv-jf2p-hpm8
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

AC:H reflects that reliably exploiting a kernel UAF during teardown requires heap shaping; other metrics match the provided vector.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.8 MEDIUM
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 08, 2026 - 15:35 vuln.today
CVSS changed
Aug 08, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Aug 06, 2026 - 08:16 EUVD
CVE Published
Aug 06, 2026 - 07:06 cve.org
HIGH 7.8
CVE Published
Aug 06, 2026 - 07:06 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

can: esd_usb: kill anchored URBs before freeing netdevs

esd_usb_disconnect() frees each CAN netdev with free_candev() inside its per-netdev loop and only calls unlink_all_urbs(dev) afterwards. The per-netdev private data (struct esd_usb_net_priv) is embedded in the net_device allocation returned by alloc_candev(), so once free_candev() has run, dev->nets[i] points to freed memory. unlink_all_urbs() then dereferences the freed dev->nets[i] to kill the per-netdev TX anchor (usb_kill_anchored_urbs(&priv->tx_submitted)), clear active_tx_jobs, and reset priv->tx_contexts[].

Reorder the teardown so the anchored URBs are killed before the netdevs are freed, matching other CAN/USB drivers in the same directory such as ems_usb, usb_8dev and mcba_usb, which unregister, then unlink, then free: unregister the netdevs first (which stops their TX queues), call unlink_all_urbs(dev) once, then free the netdevs.

This issue was found by an in-house static analysis tool.

AnalysisAI

Use-after-free in the Linux kernel esd_usb CAN driver exposes local privilege escalation on systems using ESD CAN USB hardware. The esd_usb_disconnect() teardown sequence frees each CAN netdev (and its embedded private struct) before calling unlink_all_urbs(), which then dereferences that already-freed per-netdev memory to kill TX anchors and reset TX contexts. Found by an in-house static analysis tool with no public exploit identified at time of analysis; EPSS is 0.16% (6th percentile), consistent with a niche driver defect rather than a broadly targeted flaw.

Technical ContextAI

The esd_usb driver (drivers/net/can/usb/esd_usb.c) manages ESD brand CAN-over-USB adapters in the Linux kernel CAN subsystem. Each CAN netdev is allocated via alloc_candev(), with the driver's private struct esd_usb_net_priv embedded in that allocation. On disconnect, esd_usb_disconnect() previously freed each netdev with free_candev() inside a per-netdev loop, invalidating the dev->nets[i] pointer, and then called unlink_all_urbs(dev) which dereferenced those freed pointers to invoke usb_kill_anchored_urbs(&priv->tx_submitted) and reset priv->tx_contexts[]. This is a classic CWE-416 Use After Free: a memory region is released, yet a dangling pointer to it is subsequently dereferenced. The fix canonically reorders teardown to match sibling CAN/USB drivers (ems_usb, usb_8dev, mcba_usb): unregister all netdevs (stopping TX queues), call unlink_all_urbs() once, then free the netdevs. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers all affected kernel versions from the introducing commit 96d8e90382dc.

RemediationAI

Vendor-released patches are available across all active stable branches. Upgrade to Linux 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc4 (or later) depending on the kernel series in use; the relevant commits are published at the kernel.org stable tree links in the references. Distributions (RHEL, Debian, Ubuntu, SUSE, etc.) should be monitored for backported package updates. As a compensating control on systems that do not require ESD CAN USB hardware, the esd_usb module can be blocklisted (echo 'blacklist esd_usb' >> /etc/modprobe.d/blacklist.conf && dracut -f) to prevent the driver from loading entirely, which eliminates the attack surface with no functional impact on non-CAN workloads. Restricting physical USB port access on industrial or embedded systems reduces the ability to trigger device connect/disconnect events that are prerequisite to exploitation.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

CVE-2026-64585 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy