PT-2026-61213 · Linux · Linux

CVE-2026-63896

·

Published

2026-07-19

·

Updated

2026-07-19

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: composite: fix integer underflow in WebUSB GET URL handling
The WebUSB GET URL handler in composite setup() narrows landing page length to fit the host-supplied wLength using
landing page length = w length
	- WEBUSB URL DESCRIPTOR HEADER LENGTH + landing page offset;
If wLength is smaller than WEBUSB URL DESCRIPTOR HEADER LENGTH the unsigned subtraction wraps, and the subsequent
memcpy(url descriptor->URL,
    cdev->landing page + landing page offset,
    landing page length - landing page offset);
ends up copying close to UINT MAX bytes from cdev->landing page into cdev->req->buf. KASAN reports a slab-out-of-bounds in composite setup on the kmalloc-2k gadget info allocation, and FORTIFY SOURCE traps the memcpy as a 4294967293-byte field-spanning write into url descriptor->URL (size 252).
A USB host can reach this from a single SETUP packet against any gadget that has webusb/use=1 and a landingPage configured.
Handle the small-wLength case before the math: when the host requested fewer bytes than the URL descriptor header, only the header is meaningful and no URL bytes need to be copied. Setting landing page length to landing page offset makes the existing memcpy a no-op and leaves the descriptor returned to the host unchanged for all larger wLength values.
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

CVE-2026-63896

Affected Products

Linux