CVE-2026-63897 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
Add the missing sanity check on the size of interrupt-in transfers to avoid parsing stale or uninitialised slab data (and leaking it to user space).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability in question affects the Linux kernel's USB serial driver implementation, specifically within the mct_u232 module responsible for handling USB-to-serial conversions. This flaw represents a critical security issue that could potentially expose sensitive system information through improper data handling during USB communication processes. The problem manifests in the absence of proper validation checks on interrupt-in transfer sizes, creating a scenario where malformed or uninitialized memory segments could be inadvertently exposed to user-space applications.
The technical root cause lies in the missing sanity check for interrupt-in transfers which are essential components of USB communication protocols used for asynchronous data reception from USB devices. When these transfers occur without proper size validation, the kernel fails to verify that incoming data conforms to expected parameters before processing. This oversight allows for potential memory corruption scenarios where stale or uninitialized slab memory - which is memory allocated from kernel memory pools and potentially containing previously used data - could be parsed and inadvertently disclosed to user-space processes through the USB serial interface.
The operational impact of this vulnerability extends beyond simple information disclosure, as it creates a potential pathway for attackers to extract sensitive kernel memory contents that may contain cryptographic keys, passwords, or other confidential system information. The flaw specifically affects systems running Linux kernels with the mct_u232 USB serial driver enabled, particularly those handling USB devices that utilize interrupt-in transfers for status updates or data reception. This vulnerability aligns with CWE-129, which addresses improper validation of input boundaries, and represents a classic example of how insufficient input sanitization can lead to information leakage in kernel space operations.
From an attack perspective, this vulnerability could be exploited through malicious USB devices that manipulate interrupt-in transfer sizes to trigger the parsing of uninitialized memory segments. The ATT&CK framework would categorize this as a privilege escalation technique involving kernel memory manipulation, potentially enabling attackers to gain deeper system access or extract sensitive data from running processes. The issue particularly affects systems where USB serial communication is actively used for device management, debugging, or industrial control applications where kernel memory exposure could have significant operational consequences.
The mitigation strategy involves implementing proper bounds checking on interrupt-in transfer sizes before processing the data, ensuring that all incoming transfers conform to expected parameters and that uninitialized memory segments are not inadvertently exposed. System administrators should prioritize applying kernel updates containing the fix, particularly in environments handling sensitive data or operating critical infrastructure where USB serial communication is prevalent. Additionally, monitoring for unusual USB device behavior and implementing proper USB device access controls can help reduce the attack surface while the patch is being deployed across affected systems.