CVE-2026-63902 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: cypress_m8: validate interrupt packet headers
cypress_read_int_callback() parses the interrupt-in buffer according to the selected Cypress packet format. Format 1 has a two-byte status/count header and format 2 has a one-byte combined status/count header. The usb-serial core sizes the interrupt-in buffer from the endpoint descriptor's wMaxPacketSize, and successful interrupt transfers can complete short when URB_SHORT_NOT_OK is not set.
Check that the completed packet contains the selected header before reading it. Malformed short reports are ignored and the interrupt URB is resubmitted through the existing retry path, preventing out-of-bounds header-byte reads.
KASAN report as below: KASAN slab-out-of-bounds in cypress_read_int_callback+0x240/0x7f0 Read of size 1 Call trace: cypress_read_int_callback() (drivers/usb/serial/cypress_m8.c:1009) __usb_hcd_giveback_urb() dummy_timer()
[ johan: use constants in header length sanity checks ]
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability resides within the Linux kernel's USB serial driver implementation, specifically in the cypress_m8 module responsible for handling Cypress M8 USB devices. This flaw represents a classic buffer overflow scenario that could potentially lead to system instability or security exploitation through improper memory access patterns during interrupt packet processing.
The technical implementation involves the cypress_read_int_callback function which processes interrupt-in buffers received from USB endpoints. The driver must handle two distinct packet formats with different header structures - Format 1 uses a two-byte status/count header while Format 2 employs a one-byte combined status/count header. The kernel's usb-serial core component dynamically sizes interrupt-in buffers based on the endpoint descriptor's wMaxPacketSize parameter, allowing for variable-length transfers that may complete short when URB_SHORT_NOT_OK flag is not set.
The core vulnerability stems from inadequate validation of packet headers before attempting to parse them. When malformed short reports are received, the driver previously could access memory beyond the intended buffer boundaries without proper bounds checking. This oversight resulted in a slab-out-of-bounds read condition as evidenced by the KASAN report showing a read operation of size 1 at offset 0x240 within cypress_read_int_callback function. The call trace demonstrates this occurs during USB HCD (Host Controller Driver) processing through __usb_hcd_giveback_urb and dummy_timer functions, indicating a pathway through the standard USB subsystem.
This vulnerability type maps directly to CWE-129 and CWE-787 in the Common Weakness Enumeration catalog, representing improper input validation and out-of-bounds read conditions respectively. From an adversarial perspective, this flaw aligns with ATT&CK technique T1059.001 (Command and Scripting Interpreter) and T1068 (Exploitation for Privilege Escalation) as it could potentially enable attackers to manipulate kernel memory access patterns. The fix implemented addresses the root cause by adding header length validation checks before any parsing operations, ensuring that only properly formatted packets are processed. This prevents out-of-bounds memory reads while maintaining the existing retry mechanism through the interrupt URB resubmission path for malformed reports.
The mitigation strategy leverages defensive programming principles by enforcing proper bounds checking before header parsing operations. The solution ensures that packet headers contain valid data according to the selected format before any memory access occurs, preventing potential exploitation while preserving system functionality. This approach aligns with secure coding guidelines and follows the principle of least privilege in kernel space operations, where all input validation should occur before processing potentially untrusted data from hardware devices. The implementation also incorporates constant-based header length checks as recommended by the patch author to improve maintainability and reduce future regression risks.
The vulnerability demonstrates how seemingly minor parsing logic can create significant security implications in kernel drivers, particularly when handling variable-length protocols with multiple format variants. The fix maintains backward compatibility while strengthening the driver's resilience against malformed USB interrupt reports. This represents a typical example of how embedded systems security requires careful attention to buffer management and input validation even in well-established subsystems like USB serial communication where device diversity creates complex parsing requirements that must be handled robustly to prevent exploitation opportunities.