CVE-2026-64585 Linux CVE debrief

Who should care

Linux kernel developers, CAN subsystem maintainers, and users of Linux-based systems with CAN subsystem enabled should be aware of this vulnerability. Operators of affected systems should prioritize patching to prevent potential use-after-free errors. Security teams should review system logs and monitor for unusual CAN subsystem behavior. Platform maintainers should ensure the patch is applied and verify system stability. Vulnerability management teams should track this issue and ensure affected systems are remediated. Asset owners should inventory their Linux-based systems for CAN subsystem usage and prioritize patching accordingly. Change management teams should plan and verify the patch application through normal change control processes.

Technical summary

The esd_usb driver in the Linux kernel's CAN subsystem has a use-after-free vulnerability during device disconnection. The driver frees the CAN netdevs before killing the anchored URBs, leading to a potential memory access issue. The fix involves reordering the teardown process to kill the anchored URBs before freeing the netdevs, matching the implementation of other CAN/USB drivers. This change prevents the use-after-free vulnerability and ensures the stability of the CAN subsystem.

Defensive priority

Medium

Recommended defensive actions

• Inventory and assess Linux kernel-based systems for CAN subsystem usage
• Verify and apply the patch to reorder the teardown process in the esd_usb driver
• Monitor for potential use-after-free vulnerabilities in the CAN subsystem
• Review system logs for unusual CAN subsystem behavior
• Perform a thorough vulnerability assessment of Linux-based systems
• Implement additional monitoring and detection controls for CAN subsystem activity
• Verify patch application through normal change control processes

Evidence notes

The issue was identified by an in-house static analysis tool. The fix involves reordering the teardown process to match other CAN/USB drivers in the same directory. To verify, defenders should review the CAN subsystem configuration, check for the esd_usb driver, and ensure the patch has been applied. Additional verification steps include reviewing system logs for potential use-after-free errors and monitoring for unusual CAN subsystem behavior.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.