What is the CVSS score of EUVD-2026-59649?

EUVD-2026-59649 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-59649?

A local privilege escalation vulnerability (CVE-2026-74456) in the Linux kernel's peak_usb CAN bus USB driver affects systems with PEAK USB-to-CAN hardware.. A patch is available.

How to fix or mitigate EUVD-2026-59649?

Within 24 hours, identify all Linux systems with PEAK USB-to-CAN hardware and document their current kernel versions. Within 7 days, test patched kernel versions (6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6) in a staging environment and begin deployment to production. Within 30 days, complete patch rollout across all affected systems, verify CAN bus functionality post-patch, and implement kernel security update procedures to prevent similar vulnerabilities.

Linux Kernel EUVD-2026-59649

| CVE-2026-74456 HIGH

2026-08-15 Linux

GHSA-crgv-x77w-rh88

Information Disclosure Linux Red Hat Suse

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

AC:H reflects that exploitation requires specific PEAK USB hardware physically attached and a non-trivial usb_submit_urb() failure condition during initialization.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 11:34 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:26 cve.org

HIGH 7.8

CVE Published

Aug 15, 2026 - 12:26 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error

In peak_usb_start(), each RX URB transfer buffer is allocated with kmalloc() and the URB is flagged URB_FREE_BUFFER so that the final usb_free_urb() also frees the transfer buffer.

If usb_submit_urb() fails, the error path frees the buffer explicitly with kfree(buf) and then calls usb_free_urb(urb). Because URB_FREE_BUFFER is set, usb_free_urb() -> urb_destroy() frees the same buffer a second time, a double free of the transfer buffer.

BUG: KASAN: double-free in usb_free_urb.part.0+0x91/0xb0 Free of addr ffff8881069ccb80 by task trigger.sh/285

Call Trace: kfree+0x113/0x3c0 usb_free_urb.part.0+0x91/0xb0

Drop the redundant kfree(buf); usb_free_urb() already releases the transfer buffer. This mirrors commit 03819abbeb11 ("net: usb: lan78xx: Fix double free issue with interrupt buffer allocation").

AnalysisAI

Double-free heap corruption in the Linux kernel's peak_usb CAN bus USB driver exposes systems with PEAK USB-to-CAN hardware to local privilege escalation, kernel panic, or sensitive memory disclosure. The flaw resides in the peak_usb_start() error-handling path, where a URB transfer buffer is freed explicitly via kfree(buf) before usb_free_urb() frees the same buffer a second time through the URB_FREE_BUFFER flag, corrupting kernel heap allocator metadata. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Gain local user access

Delivery

Attach or simulate PEAK USB CAN adapter

Exploit

Trigger usb_submit_urb() failure during peak_usb_start()

Execution

Double-free corrupts kernel heap

Persist

Groom heap with controlled allocation

Impact

Escalate privileges to root

Access

Gain local user access

Delivery

Attach or simulate PEAK USB CAN adapter

Exploit

Trigger usb_submit_urb() failure during peak_usb_start()

Execution

Double-free corrupts kernel heap

Persist

Groom heap with controlled allocation

Impact

Escalate privileges to root

Vulnerability AssessmentAI

Exploitation	Exploitation requires three concurrent conditions: (1) local access to the target system with at least low-privilege credentials (PR:L per CVSS); (2) a PEAK System USB-to-CAN adapter (e.g., PCAN-USB, PCAN-USB Pro) physically connected so that the peak_usb kernel module is loaded and active; and (3) the ability to trigger a usb_submit_urb() failure during the peak_usb_start() RX URB initialization sequence, which is not reliably achievable under normal USB operation and typically requires a degraded USB bus, a simulated USB environment, or USB hardware manipulation. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates real-world exploitability by assigning AC:L - triggering this vulnerability requires a PEAK USB CAN adapter physically attached to the system and a usb_submit_urb() failure condition during driver initialization, which is not reliably achievable under normal operation without hardware manipulation or a degraded USB subsystem. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A local low-privileged user on a Linux system with a PEAK USB-to-CAN adapter connected manipulates the USB environment to cause usb_submit_urb() to return an error during peak_usb_start() initialization - for example by triggering a USB bus fault or using a crafted USB device. The double-free corrupts the kernel slab allocator's freelist, and the attacker then groomes the heap by allocating a controlled object into the freed slot, gaining the ability to overwrite kernel function pointers or credentials to escalate to root.
Remediation	The primary fix is to upgrade to a patched kernel release: 6.6.151 or later for the 6.6 LTS branch, 6.12.103 or later for the 6.12 LTS branch, 6.18.44 or later, 7.1.8 or later, or mainline 7.2-rc6 or later. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all Linux systems with PEAK USB-to-CAN hardware and document their current kernel versions. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

EUVD-2026-59649 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-59649

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code