CVE-2026-63904
Received Received - Intake

USBTMC Driver Out-of-Bounds Read in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: check URB actual_length for interrupt-IN notifications USBTMC devices can use an optional interrupt endpoint for notification messages. These typically contain two-byte headers indicating the payload format, but the driver does not check if these headers are present before accessing the data buffers. In cases where the URB actual_length is not enough to fit these headers, the driver will either cause an out-of-bounds read, or consume stale leftover data from a previous notification. Fix by checking if actual_data contains enough bytes for the headers, otherwise resubmit URB to the interrupt endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63904
EUVD
EUVD-2026-45677

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Linux kernel's USB Test and Measurement Class (USBTMC) driver. It involves improper handling of interrupt-IN notifications from USBTMC devices. The driver fails to verify if the received data contains the required two-byte header before processing it. This can lead to out-of-bounds reads or consumption of stale data if the URB actual_length is insufficient.

Detection Guidance

This vulnerability is specific to USBTMC devices in the Linux kernel. Detection requires checking kernel logs for USBTMC-related errors or examining USB device behavior. Commands like dmesg | grep usbtmc or lsusb -v may help identify affected devices. No direct network detection is applicable.

Impact Analysis

This vulnerability could allow an attacker with physical access to a system using a vulnerable USBTMC device to cause a denial-of-service condition or potentially execute arbitrary code with kernel privileges. It may also lead to system instability or crashes due to memory corruption.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a low-level USB driver issue in the Linux kernel. Compliance impacts would depend on how the affected system is used, not the vulnerability itself.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this vulnerability. Avoid using untrusted USBTMC devices until patched. Monitor kernel logs for unusual USBTMC activity as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63904. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart