Executive brief
A vulnerability in the Linux kernel's Moxa USB-to-serial driver could allow a malicious USB device to cause memory corruption. By reporting an unexpectedly small packet size, a specially crafted device could trigger a system crash or potentially allow for unauthorized code execution when plugged into a computer. This issue primarily affects systems that allow the connection of untrusted physical USB hardware.
Technical details
A memory corruption vulnerability exists in the mxuport USB-to-serial driver (drivers/usb/serial/mxuport.c) within the Linux kernel. The root cause is a lack of validation for the bulk-out endpoint's maximum packet size (maxp). A malicious USB device can report a max packet size smaller than the required four-byte header plus data (specifically less than eight bytes), leading to user-controlled slab corruption during data transfer. This requires physical access to plug in a malicious device. The fix implements a check in mxuport_calc_num_ports to ensure the endpoint size is at least eight bytes, returning -EINVAL otherwise.
Affected products
- Linux Linux Kernel 3.14 to 6.6.143
Timeline
- 2026-05-22: disclosed: Vulnerability identified and patch authored by Johan Hovold.
- 2026-07-19: advisory: CVE-2026-63899 published.
References
- https://git.kernel.org/stable/c/086b858b5f5125bc9d967ea2bd825f83d9f8f29d
- https://git.kernel.org/stable/c/2f3661eb2446e1ef593da45e01a3b21a906768ec
- https://git.kernel.org/stable/c/4085f0dbb1ce2251c9a5938d693de6593f0ab2bd
- https://git.kernel.org/stable/c/6c0cf56f00f280d72180bb6ce79741bc787a6269
- https://git.kernel.org/stable/c/b40166b4ef96067620a0f248e74ad9658c8f680c
- https://git.kernel.org/stable/c/be3a1ed4ae51fa8dde57383277d336ce834f2cd9
- https://git.kernel.org/stable/c/ccbec56f2f9af008f1574335cc6a668f16603e47