CVE-2026-74458

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents<br /> <br /> The wait and bulk receive paths walk variable-length commands from a<br /> USB buffer. A nonzero command shorter than CMD_HEADER_LEN can still be<br /> dispatched, and the wait path copies a matching command into a fixed<br /> caller-owned struct kvaser_cmd using the device-provided length.<br /> <br /> Reject nonzero commands that do not contain the fixed header or that<br /> extend beyond the current USB buffer item. In the wait path, also reject<br /> a matching command that exceeds the destination before copying it.