Strix
57.7K

CVE-2026-74460

UnknownEPSS 0.17%

Last modified

CVE-2026-74460 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: validate CPC message lengths ems_usb_read_bulk_callback() walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the fields used by the CAN, state, error and overrun handlers.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: validate CPC message lengths ems_usb_read_bulk_callback() walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the fields used by the CAN, state, error and overrun handlers.

Metrics

EPSS Probability
0.17%

6.5th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 702171adeed3607ee9603ec30ce081411e36ae42, < bb3cc8da8a2967c0f8e83d148fc6870b19fa32c6; >= 702171adeed3607ee9603ec30ce081411e36ae42, < db5655287d78f00daf98888a520bb8da4d30126d; >= 702171adeed3607ee9603ec30ce081411e36ae42, < ce8125566b1d0b0f16449407e014addf451804ea; >= 702171adeed3607ee9603ec30ce081411e36ae42, < 0b9090717c7e2184e2c427bbcc752f295116ac1d; >= 702171adeed3607ee9603ec30ce081411e36ae42, < 0b23144c59c126beb4a7761a85a194ae0fe668a5; >= 702171adeed3607ee9603ec30ce081411e36ae42, < df3ac2a672a5284441f120d486acabdd6740fc2a; >= 702171adeed3607ee9603ec30ce081411e36ae42, < 02925f51377f2a42a6724f00549167499c9302e5
LinuxLinux2.6.32

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-74460?
In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: validate CPC message lengths ems_usb_read_bulk_callback() walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the fields used by the CAN, state, error and overrun handlers.
How severe is CVE-2026-74460?
Severity scoring for CVE-2026-74460 is pending analysis. The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.
How do I fix CVE-2026-74460?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-74460?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST