CVE-2026-74460 can: ems_usb: validate CPC message lengths
A missing length validation in the Linux kernel ems_usb driver allows a local attacker to cause a denial of service via a malicious USB device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74460?
CVE-2026-74460 is a denial of service vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
can: ems_usb: validate CPC message lengths
ems_usb_read_bulk_callback() walks CPC messages packed in one USB receive buffer.
Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the fields used by the CAN, state, error and overrun handlers.
Which versions are affected by CVE-2026-74460?
How do I fix CVE-2026-74460?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-74460 being exploited?
There is no known exploitation of CVE-2026-74460 in the wild and no public exploit code.
Sources
Also known as AZL-96069, BELL-CVE-2026-74460, DEBIAN-CVE-2026-74460, GHSA-596r-rcx5-45wx, UBUNTU-CVE-2026-74460.