CVE-2026-64585: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64585 Overview

CVE-2026-64585 is a use-after-free vulnerability in the Linux kernel esd_usb CAN (Controller Area Network) driver. The flaw lives in the esd_usb_disconnect() teardown path, where the driver frees each CAN net_device with free_candev() before calling unlink_all_urbs(). Because the per-netdev private data struct esd_usb_net_priv is embedded inside the net_device allocation returned by alloc_candev(), the later call to unlink_all_urbs() dereferences already-freed memory when killing the per-netdev TX anchor and resetting priv->tx_contexts[]. The issue was found by an in-house static analysis tool and fixed by reordering teardown to unregister, unlink, then free.

Critical Impact
Use-after-free in esd_usb_disconnect() can lead to kernel memory corruption when an esd CAN-USB device is disconnected.

Affected Products

Linux kernel builds that include the esd_usb CAN driver (drivers/net/can/usb/esd_usb.c)
Systems using esd electronics CAN-USB hardware managed by this driver
Downstream distributions carrying the affected driver revision prior to the referenced stable patches

Discovery Timeline

2026-08-06 - CVE-2026-64585 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-64585

Vulnerability Analysis

The esd_usb driver manages multiple CAN network interfaces backed by a single USB device. During disconnect, esd_usb_disconnect() iterates over each dev->nets[i], calls unregister_netdev() and free_candev() inside the loop, then finally calls unlink_all_urbs(dev) once the loop finishes.

The private structure esd_usb_net_priv is embedded in the memory returned by alloc_candev(). Once free_candev() runs for a given netdev, the pointer dev->nets[i] and the priv it wraps refer to freed memory. unlink_all_urbs() subsequently dereferences that freed pointer to reach priv->tx_submitted for usb_kill_anchored_urbs(), to clear active_tx_jobs, and to reset priv->tx_contexts[].

Any anchored URB completing during this window operates on freed state, opening a path to kernel heap corruption. This aligns with classic use-after-free behavior [CWE-416] in kernel USB teardown routines.

Root Cause

The root cause is ordering: teardown frees the object that still owns live USB anchors and TX bookkeeping. Sibling CAN/USB drivers such as ems_usb, usb_8dev, and mcba_usb follow the correct pattern of unregister, then unlink, then free. The esd_usb driver diverged from that pattern, leaving unlink_all_urbs() to touch memory that free_candev() had already released.

Attack Vector

Exploitation requires the affected driver to be loaded and an esd CAN-USB device to be present or emulated. Triggering the vulnerable path depends on device disconnect while URBs remain anchored, so the practical attack surface centers on local scenarios involving physical or virtual USB device manipulation. See the referenced Kernel Patch 5832c55 and companion commits for the exact code changes.

// No verified public exploit code is available.
// The fix reorders teardown to: unregister netdevs -> unlink_all_urbs(dev) -> free_candev().

Detection Methods for CVE-2026-64585

Indicators of Compromise

Kernel oops or KASAN use-after-free reports referencing esd_usb, unlink_all_urbs, or usb_kill_anchored_urbs around USB disconnect events
Unexpected esd_usb module crashes correlated with hot-unplug of CAN-USB adapters
Slab corruption warnings in dmesg following esd CAN-USB removal

Detection Strategies

Enable KASAN on test kernels to surface the use-after-free during esd_usb_disconnect() execution
Audit installed kernel versions against the stable patches listed in the references to confirm the fix is present
Monitor kernel logs for esd_usb subsystem messages coinciding with USB device removal

Monitoring Recommendations

Forward kernel logs (dmesg, journalctl -k) from Linux endpoints and industrial hosts to a centralized log store for review
Alert on repeated kernel panics or module faults involving CAN/USB drivers on the same host
Track USB device attach and detach events on systems where CAN-USB hardware is in use

How to Mitigate CVE-2026-64585

Immediate Actions Required

Upgrade to a Linux kernel that includes the fix commits referenced by the CVE, or apply the stable backports to your build
On systems that do not require esd CAN-USB support, unload and blacklist the esd_usb module until patched
Restrict physical and administrative access to USB ports on hosts running the affected driver

Patch Information

The fix reorders teardown in esd_usb_disconnect() so that netdevs are unregistered first, unlink_all_urbs(dev) runs once against still-valid priv pointers, and only then is each netdev freed with free_candev(). Apply one of the following stable patches: Kernel Patch 5832c55, Kernel Patch 765ba1c9, Kernel Patch a02e1d8f, Kernel Patch a3314f10, Kernel Patch aa1d0059, or Kernel Patch c43122fe.

Workarounds

Blacklist the esd_usb module on hosts that do not require esd CAN-USB devices
Avoid hot-unplugging esd CAN-USB adapters on unpatched kernels; power down before disconnecting
Limit exposure by ensuring only trusted users can attach USB devices to affected systems

bash

# Prevent the vulnerable driver from loading until the kernel is patched
echo 'blacklist esd_usb' | sudo tee /etc/modprobe.d/blacklist-esd_usb.conf
sudo modprobe -r esd_usb 2>/dev/null || true
sudo update-initramfs -u