CVE-2026-64585

In the Linux kernel, the following vulnerability has been resolved:

can: esd_usb: kill anchored URBs before freeing netdevs

esdusbdisconnect() frees each CAN netdev with freecandev() inside its per-netdev loop and only calls unlinkallurbs(dev) afterwards. The per-netdev private data (struct esdusbnetpriv) is embedded in the netdevice allocation returned by alloccandev(), so once freecandev() has run, dev->nets[i] points to freed memory. unlinkallurbs() then dereferences the freed dev->nets[i] to kill the per-netdev TX anchor (usbkillanchoredurbs(&priv->txsubmitted)), clear activetxjobs, and reset priv->txcontexts[].

Reorder the teardown so the anchored URBs are killed before the netdevs are freed, matching other CAN/USB drivers in the same directory such as emsusb, usb8dev and mcbausb, which unregister, then unlink, then free: unregister the netdevs first (which stops their TX queues), call unlinkall_urbs(dev) once, then free the netdevs.

This issue was found by an in-house static analysis tool.