PT-2026-61219 · Linux · Linux
CVE-2026-63902
·
Published
2026-07-19
·
Updated
2026-07-19
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: cypress m8: validate interrupt packet headers
cypress read int callback() parses the interrupt-in buffer according to
the selected Cypress packet format. Format 1 has a two-byte status/count
header and format 2 has a one-byte combined status/count header. The
usb-serial core sizes the interrupt-in buffer from the endpoint
descriptor's wMaxPacketSize, and successful interrupt transfers can
complete short when URB SHORT NOT OK is not set.
Check that the completed packet contains the selected header before
reading it. Malformed short reports are ignored and the interrupt URB is
resubmitted through the existing retry path, preventing out-of-bounds
header-byte reads.
KASAN report as below:
KASAN slab-out-of-bounds in cypress read int callback+0x240/0x7f0
Read of size 1
Call trace:
cypress read int callback() (drivers/usb/serial/cypress m8.c:1009)
usb hcd giveback urb()
dummy timer()
[ johan: use constants in header length sanity checks ]
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux