{"cve":"CVE-2026-74459","nvd":{"published":"2026-08-15T13:17:50.543","modified":"2026-08-19T17:21:02.803","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure\n\nes58x_read_bulk_callback() resubmits the RX URB after processing a received\npacket. If the resubmit succeeds, the URB remains anchored and will be\nhandled by the normal RX path or by teardown.\n\nHowever, if usb_submit_urb() fails, the callback unanchors the URB and then\nreturns directly. This skips the existing free_urb path, so the coherent\ntransfer buffer allocated with usb_alloc_coherent() is not released.\n\nReuse the existing free_urb path after a resubmit failure so that the RX\ncoherent buffer is freed before leaving the callback.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/0ef136ba052101243ba117a1aca6f4a4c3a81142","https://git.kernel.org/stable/c/19c6c8c6cd5dd14fab5fcd744584812a57cbb78d","https://git.kernel.org/stable/c/21da1a374769751546cc131e58a4d8bd968f57b2","https://git.kernel.org/stable/c/7a0cf2b2497c757c3cb1286eddf2986abb0d387b","https://git.kernel.org/stable/c/b85e5c310382803d27adf6fe6554d4208bc8951c"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:49:10.689564601+00:00"},"epss":{"cve":"CVE-2026-74459","score":0.00215,"percentile":0.11867,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}