PT-2026-61213 · Linux · Linux

CVE-2026-63896

·

Publicado

2026-07-19

·

Atualizado

2026-07-19

Nenhuma

Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: composite: fix integer underflow in WebUSB GET URL handling
The WebUSB GET URL handler in composite setup() narrows landing page length to fit the host-supplied wLength using
landing page length = w length
	- WEBUSB URL DESCRIPTOR HEADER LENGTH + landing page offset;
If wLength is smaller than WEBUSB URL DESCRIPTOR HEADER LENGTH the unsigned subtraction wraps, and the subsequent
memcpy(url descriptor->URL,
    cdev->landing page + landing page offset,
    landing page length - landing page offset);
ends up copying close to UINT MAX bytes from cdev->landing page into cdev->req->buf. KASAN reports a slab-out-of-bounds in composite setup on the kmalloc-2k gadget info allocation, and FORTIFY SOURCE traps the memcpy as a 4294967293-byte field-spanning write into url descriptor->URL (size 252).
A USB host can reach this from a single SETUP packet against any gadget that has webusb/use=1 and a landingPage configured.
Handle the small-wLength case before the math: when the host requested fewer bytes than the URL descriptor header, only the header is meaningful and no URL bytes need to be copied. Setting landing page length to landing page offset makes the existing memcpy a no-op and leaves the descriptor returned to the host unchanged for all larger wLength values.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-63896

Produtos afetados

Linux