Executive brief
A vulnerability was identified in the Linux kernel's driver for Cypress USB-to-serial adapters. An attacker with physical access to a computer could plug in a specially crafted USB device to cause a system crash or instability. This issue affects systems using older Cypress M8 USB serial hardware.
Technical details
A slab-out-of-bounds read vulnerability was discovered in cypress_read_int_callback() within drivers/usb/serial/cypress_m8.c. The driver parses interrupt-in buffers based on Cypress packet formats (Format 1 or 2) without verifying that the received URB (USB Request Block) contains enough data to satisfy the expected header length (1 or 2 bytes). If a short packet is received, the driver attempts to read header bytes from the buffer, resulting in an out-of-bounds read as reported by KASAN. The fix introduces sanity checks on the actual length of the received data before header parsing. Patches are available across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 2.6.26 to 7.1.y
Timeline
- 2026-05-22: disclosed: Vulnerability reported by Zhang Cen
- 2026-06-19: patched: Fix committed to stable kernel tree
- 2026-07-19: advisory: CVE-2026-63902 published
References
- https://git.kernel.org/stable/c/44f9bab8df7750a1e2a4d6cc22d7c9c2dc096aed
- https://git.kernel.org/stable/c/4a4cb0021ebe1fcadb52e04d19ed8d71470a530b
- https://git.kernel.org/stable/c/90664556916de22467097d4c8ceb716d597a5c32
- https://git.kernel.org/stable/c/9f9bfc80c67f35a275820da7e83a35dface08281
- https://git.kernel.org/stable/c/aaa66708bfb1dca2acd219d1c1582f9f6d5492cb
- https://git.kernel.org/stable/c/ae03453f2c809ca3cf73753269fa6184dea7160f
- https://git.kernel.org/stable/c/be50533fe7068e86eb7adb81988e6d6a3f6dfe53