CVE-2026-63896 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
The WebUSB GET_URL handler in composite_setup() narrows landing_page_length to fit the host-supplied wLength using
landing_page_length = w_length - WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH + landing_page_offset;
If wLength is smaller than WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH the unsigned subtraction wraps, and the subsequent
memcpy(url_descriptor->URL, cdev->landing_page + landing_page_offset, landing_page_length - landing_page_offset);
ends up copying close to UINT_MAX bytes from cdev->landing_page into cdev->req->buf. KASAN reports a slab-out-of-bounds in composite_setup on the kmalloc-2k gadget_info allocation, and FORTIFY_SOURCE traps the memcpy as a 4294967293-byte field-spanning write into url_descriptor->URL (size 252).
A USB host can reach this from a single SETUP packet against any gadget that has webusb/use=1 and a landingPage configured.
Handle the small-wLength case before the math: when the host requested fewer bytes than the URL descriptor header, only the header is meaningful and no URL bytes need to be copied. Setting landing_page_length to landing_page_offset makes the existing memcpy a no-op and leaves the descriptor returned to the host unchanged for all larger wLength values.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability resides in the Linux kernel's USB gadget subsystem specifically within the composite USB device driver implementation. This flaw manifests in the WebUSB GET_URL handling mechanism where the kernel fails to properly validate the wLength parameter provided by a USB host during a SETUP packet transaction. The issue occurs when processing USB requests for WebUSB descriptors, which are used to enable web-based USB device communication through browsers without requiring additional drivers or software installations.
The technical root cause involves an integer underflow condition that arises from improper bounds checking in the composite_setup() function. When a USB host sends a GET_URL request with a wLength value smaller than the WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH constant, the unsigned arithmetic operation causes an underflow due to wraparound behavior. This mathematical error results in a massive negative value being calculated for landing_page_length, which when used as a copy length parameter in subsequent memcpy operations, triggers buffer overflows and memory corruption issues.
The operational impact of this vulnerability is significant as it allows remote attackers to exploit the flaw through a single USB SETUP packet against any composite USB gadget that has WebUSB functionality enabled with a landing page configured. This creates a potential attack vector where malicious USB devices or compromised hosts could trigger the memory corruption, potentially leading to privilege escalation or system instability. The vulnerability affects all Linux systems running kernel versions containing this specific bug, particularly those supporting USB gadget drivers with WebUSB capabilities.
The exploitation scenario begins with a USB host sending a malformed SETUP packet with an inappropriate wLength value that triggers the integer underflow condition. This causes the memcpy operation to attempt copying an enormous amount of data - specifically around 4.3 billion bytes - from the kernel's landing page buffer into the response descriptor. Security frameworks like KASAN (Kernel Address Sanitizer) detect this out-of-bounds memory access during the kmalloc-2k gadget_info allocation, while FORTIFY_SOURCE mechanisms trap the invalid memcpy operation that spans across the entire URL field size of 252 bytes.
This vulnerability maps to CWE-190, Integer Overflow or Wraparound, and aligns with ATT&CK technique T1059.006 for command and script injection through USB device manipulation. The fix requires implementing proper bounds checking before performing the arithmetic operation, specifically ensuring that when wLength is smaller than the required header length, only the header portion should be returned without attempting to copy URL data. This defensive programming approach prevents the underflow condition while maintaining backward compatibility with legitimate requests.
The recommended mitigation strategy involves updating affected Linux kernel versions to patches that implement proper validation of the wLength parameter before arithmetic operations, ensuring that the landing_page_length variable never becomes negative or excessively large due to unsigned integer wraparound. System administrators should prioritize kernel updates and maintain awareness of USB device configurations that might expose this vulnerability through WebUSB-enabled gadgets in enterprise environments where USB device management policies are critical for security posture maintenance.
The fix implementation requires modifying the composite_setup() function to include early validation logic that checks if wLength is insufficient for the header before performing the subtraction operation. When the host requests fewer bytes than the header size, the code should set landing_page_length to landing_page_offset to make the memcpy operation a no-op while preserving all existing functionality for legitimate larger wLength values. This approach maintains the original behavior for valid requests while preventing the exploitable memory corruption scenario through proper input validation and defensive programming practices.