PT-2026-61221 · Linux · Linux

CVE-2026-63904 · Published 2026-07-19 · Updated 2026-07-19

NVD

In the Linux kernel, the following vulnerability has been resolved:

usb: usbtmc: check URB actual length for interrupt-IN notifications

USBTMC devices can use an optional interrupt endpoint for notification messages. These typically contain two-byte headers indicating the payload format, but the driver does not check if these headers are present before accessing the data buffers. In cases where the URB actual length is not enough to fit these headers, the driver will either cause an out-of-bounds read, or consume stale leftover data from a previous notification.

Fix by checking if actual data contains enough bytes for the headers, otherwise resubmit URB to the interrupt endpoint.

Related Identifiers

CVE-2026-63904

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-63904 · Security Note
• https://git.kernel.org/stable/c/69020fa089f1bf0e1a10a15265f31b143a846409 · Note
• https://git.kernel.org/stable/c/75f6d3da2cc646983f41807ef98851569c12bca9 · Note
• https://git.kernel.org/stable/c/ae87f505917e703ae3b487d9663d78826ff43608 · Note
• https://git.kernel.org/stable/c/52f2ad3f7e5eb3b5908e1d685d4342519dc9cfcd · Note
• https://git.kernel.org/stable/c/e3eec3005de44e7f37d8d7724be636446516ab42 · Note
• https://git.kernel.org/stable/c/f141b01eaa58ac7e323931d670318aa247bff087 · Note
• https://git.kernel.org/stable/c/5de7df75ef3a2756b25fe3d582a4a2970444fe5a · Note
• https://git.kernel.org/stable/c/e794bd67b3faf98af46f958897f6b91412c7d2a9 · Note