Junglewise Threat Intelligence

CVE-2026-63903: Linux Kernel out-of-bounds read in Belkin USB serial driver

CVE-2026-63903 · Severity: info · CVSS 4.6 · Published 2026-07-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Belkin USB serial driver could allow a system crash when a specially crafted or malfunctioning USB device is plugged in. The issue occurs because the driver does not properly check the size of incoming data before reading it, leading to an out-of-bounds memory access. This could result in a denial-of-service (system crash) but requires physical access to the machine to connect the USB device.

Technical details

An out-of-bounds (OOB) read vulnerability exists in the belkin_sa_read_int_callback() function within drivers/usb/serial/belkin_sa.c. The driver assumes interrupt packets are at least four bytes long to read Line Status Register (LSR) and Modem Status Register (MSR) fields at specific offsets. However, if a device sends a 'short' packet (less than 4 bytes), the driver attempts to read beyond the actual data buffer. This was identified via KASAN as a slab-out-of-bounds read. An attacker with physical access could use a malicious USB device to trigger this condition, causing a kernel panic. The issue has been patched by adding a length check on the completed interrupt packet.

Affected products

  • Linux Linux Kernel All versions prior to 6.10, 6.9.4, 6.6.33, 6.1.93, 5.15.161, 5.10.219, 5.4.278, 4.19.316

Timeline

  • 2026-05-19: other: Vulnerability reported by Zhang Cen
  • 2026-06-09: patched: Fixes merged into various stable branches
  • 2026-07-19: disclosed: CVE-2026-63903 published

References