Memory Management Flaw in Linux Kernel Affects CAN Network Devices

CVE-2026-64585

What is CVE-2026-64585?

The Linux kernel contains a vulnerability related to the esd_usb module's handling of CAN network devices. Specifically, during the disconnection process, the function esd_usb_disconnect() improperly frees network devices before terminating their associated USB requests. This leads to dereferencing freed memory, posing a risk to system stability and security. The vulnerability was identified through an in-house static analysis tool. A reordering of the teardown process is advised, similar to the implementation in other CAN/USB drivers, to ensure that USB requests are cleanly unlinked before freeing the network devices.

References