CVE-2026-63901 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: digi_acceleport: fix memory corruption with small endpoints
Add the missing bulk-out buffer size sanity checks to avoid out-of-bounds memory accesses or slab corruption should a malicious device report smaller buffers than expected.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability in question affects the Linux kernel's USB serial driver implementation, specifically within the digi_acceleport module that handles communication with certain Digi AccelPort USB devices. This issue represents a critical memory corruption flaw that could potentially lead to system instability or privilege escalation depending on the execution context. The vulnerability arises from insufficient validation of endpoint buffer sizes during device enumeration and configuration phases, creating an attack surface where malicious USB hardware could manipulate reported buffer dimensions to trigger memory access violations.
The technical root cause stems from inadequate input validation within the USB serial driver's bulk-out endpoint handling code. When a USB device communicates with the Linux kernel through the digi_acceleport driver, it reports the size of its bulk-out endpoints during the device configuration process. The kernel's implementation fails to verify that these reported buffer sizes meet minimum requirements or are consistent with expected values. This absence of validation allows devices to specify buffer sizes that are smaller than what the kernel expects during data transmission operations, leading to out-of-bounds memory writes when the driver attempts to copy data into these insufficiently sized buffers.
The operational impact of this vulnerability extends beyond simple memory corruption scenarios as it can potentially enable attackers to execute arbitrary code within kernel space or cause system crashes through controlled memory corruption. When a malicious USB device presents buffer sizes that are smaller than anticipated, subsequent data transfers can overwrite adjacent memory regions, potentially corrupting kernel data structures or even enabling privilege escalation attacks. This type of vulnerability directly relates to CWE-122, which describes heap-based buffer overflow conditions, and aligns with ATT&CK technique T1059.006 for kernel-mode exploitation through device driver vulnerabilities.
System administrators and security professionals should prioritize patching this vulnerability across all Linux systems that support USB serial communication, particularly servers and workstations that may be connected to untrusted USB devices. The fix involves implementing proper buffer size validation checks that ensure reported bulk-out endpoint sizes meet minimum requirements before allowing device configuration to proceed. This defensive measure prevents malicious devices from manipulating endpoint characteristics to exploit memory corruption vulnerabilities. Organizations should also consider implementing USB device access controls and monitoring for suspicious device enumeration patterns as additional protective measures against similar classes of vulnerabilities in USB device drivers.
The resolution demonstrates the importance of proper input validation in kernel space drivers, where untrusted device inputs can directly impact system stability and security. This vulnerability highlights the need for comprehensive testing of device driver implementations against malicious or malformed device behavior, particularly in USB subsystems where devices have significant control over their reported capabilities. The fix serves as a reminder that even seemingly benign device configuration parameters can become attack vectors when proper validation mechanisms are absent from kernel space code paths.