Executive brief
A vulnerability was identified in the Linux kernel's support for Keyspan USB-to-serial adapters. The software failed to properly check the size of incoming data packets from certain hardware models (USA-49WG and USA-28XG). This could allow the system to process uninitialized or stale memory data, potentially leading to system instability or information disclosure if a malicious or malfunctioning USB device is connected.
Technical details
A vulnerability in the 'usa49wg_indat_callback' function within 'drivers/usb/serial/keyspan.c' in the Linux kernel was caused by a missing sanity check on the length of 'indat' transfers. Specifically, the driver did not verify that the USB Request Block (URB) actual length contained enough data (at least 3 bytes) before parsing. This flaw could allow the driver to process stale or uninitialized slab data. An attacker with physical access could potentially exploit this by connecting a specially crafted USB device to trigger an out-of-bounds read or information leak from kernel memory. The issue has been resolved by adding the necessary length checks in the callback function.
Affected products
- Linux Linux Kernel 2.6.23 to 5.10.259, 5.15.210, 6.1.176, 6.6.143
Timeline
- 2026-05-20: patched: Initial fix authored by Johan Hovold
- 2026-07-19: disclosed: CVE-2026-63900 published
References
- https://git.kernel.org/stable/c/0bde5431037a076ff3750da2165fd77a6f5ff058
- https://git.kernel.org/stable/c/3759a40738b83bb61699c85f063202b514b94f77
- https://git.kernel.org/stable/c/41d9673941eebdde62ee73848fcfe4ae1105c979
- https://git.kernel.org/stable/c/ab8336a7e414f018430aa1af3a46944032f7ff96
- https://git.kernel.org/stable/c/bd6c5fe59f374b63173afe5cf0ab38a9a370f2c1
- https://git.kernel.org/stable/c/e124120e89b61a967e40dee6b5e1ecafc45c09d9
- https://git.kernel.org/stable/c/ea2b792330b44b6d7ce671c3e1d59d0c121f7ed1