CVE-2026-64585

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> can: esd_usb: kill anchored URBs before freeing netdevs<br /> <br /> esd_usb_disconnect() frees each CAN netdev with free_candev() inside<br /> its per-netdev loop and only calls unlink_all_urbs(dev) afterwards.<br /> The per-netdev private data (struct esd_usb_net_priv) is embedded in<br /> the net_device allocation returned by alloc_candev(), so once<br /> free_candev() has run, dev-&gt;nets[i] points to freed memory.<br /> unlink_all_urbs() then dereferences the freed dev-&gt;nets[i] to kill the<br /> per-netdev TX anchor (usb_kill_anchored_urbs(&amp;priv-&gt;tx_submitted)),<br /> clear active_tx_jobs, and reset priv-&gt;tx_contexts[].<br /> <br /> Reorder the teardown so the anchored URBs are killed before the netdevs<br /> are freed, matching other CAN/USB drivers in the same directory such as<br /> ems_usb, usb_8dev and mcba_usb, which unregister, then unlink, then<br /> free: unregister the netdevs first (which stops their TX queues), call<br /> unlink_all_urbs(dev) once, then free the netdevs.<br /> <br /> This issue was found by an in-house static analysis tool.