CVE-2026-63902
Received Received - Intake

USB: serial: cypress_m8 header validation vulnerability

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypress_m8: validate interrupt packet headers cypress_read_int_callback() parses the interrupt-in buffer according to the selected Cypress packet format. Format 1 has a two-byte status/count header and format 2 has a one-byte combined status/count header. The usb-serial core sizes the interrupt-in buffer from the endpoint descriptor's wMaxPacketSize, and successful interrupt transfers can complete short when URB_SHORT_NOT_OK is not set. Check that the completed packet contains the selected header before reading it. Malformed short reports are ignored and the interrupt URB is resubmitted through the existing retry path, preventing out-of-bounds header-byte reads. KASAN report as below: KASAN slab-out-of-bounds in cypress_read_int_callback+0x240/0x7f0 Read of size 1 Call trace: cypress_read_int_callback() (drivers/usb/serial/cypress_m8.c:1009) __usb_hcd_giveback_urb() dummy_timer() [ johan: use constants in header length sanity checks ]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63902
EUVD
EUVD-2026-45675

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cypress usb_serial *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper validation of interrupt packet headers in the Cypress USB serial driver (cypress_m8). The function cypress_read_int_callback() fails to check if the received packet contains the expected header before processing it, leading to potential out-of-bounds memory reads when handling malformed short reports.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB serial driver for Cypress devices. Detection requires checking kernel logs for KASAN slab-out-of-bounds errors related to cypress_read_int_callback. Monitor dmesg or journalctl for errors like 'KASAN slab-out-of-bounds in cypress_read_int_callback'.

Impact Analysis

This vulnerability could allow an attacker to trigger a kernel memory corruption issue by sending malformed USB interrupt packets. This might lead to system crashes, privilege escalation, or denial of service on affected systems using the Cypress USB serial driver.

Compliance Impact

This vulnerability is a low-level kernel memory corruption issue in USB serial driver code. It does not directly relate to data protection, encryption, or access controls required by standards like GDPR or HIPAA. No evidence suggests this flaw impacts compliance with those regulations.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Update to a kernel version containing the fix for cypress_m8.c. If immediate patching is not possible, disable the affected Cypress USB serial driver module (cypress_m8) to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63902. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart