PT-2026-61221 · Linux · Linux

CVE-2026-63904 · Publicado 2026-07-19 · Atualizado 2026-07-19

NVD

In the Linux kernel, the following vulnerability has been resolved:

usb: usbtmc: check URB actual length for interrupt-IN notifications

USBTMC devices can use an optional interrupt endpoint for notification messages. These typically contain two-byte headers indicating the payload format, but the driver does not check if these headers are present before accessing the data buffers. In cases where the URB actual length is not enough to fit these headers, the driver will either cause an out-of-bounds read, or consume stale leftover data from a previous notification.

Fix by checking if actual data contains enough bytes for the headers, otherwise resubmit URB to the interrupt endpoint.

Identificadores relacionados

CVE-2026-63904

Produtos afetados

Linux

Referências · 9

• https://git.kernel.org/stable/c/69020fa089f1bf0e1a10a15265f31b143a846409 · Nota
• https://git.kernel.org/stable/c/75f6d3da2cc646983f41807ef98851569c12bca9 · Nota
• https://git.kernel.org/stable/c/ae87f505917e703ae3b487d9663d78826ff43608 · Nota
• https://git.kernel.org/stable/c/52f2ad3f7e5eb3b5908e1d685d4342519dc9cfcd · Nota
• https://git.kernel.org/stable/c/e3eec3005de44e7f37d8d7724be636446516ab42 · Nota
• https://git.kernel.org/stable/c/f141b01eaa58ac7e323931d670318aa247bff087 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63904 · Nota de Segurança
• https://git.kernel.org/stable/c/5de7df75ef3a2756b25fe3d582a4a2970444fe5a · Nota
• https://git.kernel.org/stable/c/e794bd67b3faf98af46f958897f6b91412c7d2a9 · Nota