USB: serial: cypress_m8: validate interrupt packet headers

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2026-63902
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-07-19 16:17:07 UTC
Updated2026-07-19 16:17:07 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: USB: serial: cypress_m8: validate interrupt packet headers cypress_read_int_callback() parses the interrupt-in buffer according to the selected Cypress packet format. Format 1 has a two-byte status/count header and format 2 has a one-byte combined status/count header. The usb-serial core sizes the interrupt-in buffer from the endpoint descriptor's wMaxPacketSize, and successful interrupt transfers can complete short when URB_SHORT_NOT_OK is not set. Check that the completed packet contains the selected header before reading it. Malformed short reports are ignored and the interrupt URB is resubmitted through the existing retry path, preventing out-of-bounds header-byte reads. KASAN report as below: KASAN slab-out-of-bounds in cypress_read_int_callback+0x240/0x7f0 Read of size 1 Call trace: cypress_read_int_callback() (drivers/usb/serial/cypress_m8.c:1009) __usb_hcd_giveback_urb() dummy_timer() [ johan: use constants in header length sanity checks ]

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 3416eaa1f8f8d516b77de514e14cf8da256d28fb fcef31a5a85ccf3c313449a866ec6ed7e4132425 git Not specified
CNA Linux Linux affected 3416eaa1f8f8d516b77de514e14cf8da256d28fb aaa66708bfb1dca2acd219d1c1582f9f6d5492cb git Not specified
CNA Linux Linux affected 3416eaa1f8f8d516b77de514e14cf8da256d28fb 44f9bab8df7750a1e2a4d6cc22d7c9c2dc096aed git Not specified
CNA Linux Linux affected 3416eaa1f8f8d516b77de514e14cf8da256d28fb be50533fe7068e86eb7adb81988e6d6a3f6dfe53 git Not specified
CNA Linux Linux affected 3416eaa1f8f8d516b77de514e14cf8da256d28fb 90664556916de22467097d4c8ceb716d597a5c32 git Not specified
CNA Linux Linux affected 3416eaa1f8f8d516b77de514e14cf8da256d28fb ae03453f2c809ca3cf73753269fa6184dea7160f git Not specified
CNA Linux Linux affected 3416eaa1f8f8d516b77de514e14cf8da256d28fb 4a4cb0021ebe1fcadb52e04d19ed8d71470a530b git Not specified
CNA Linux Linux affected 3416eaa1f8f8d516b77de514e14cf8da256d28fb 9f9bfc80c67f35a275820da7e83a35dface08281 git Not specified
CNA Linux Linux affected 2.6.26 Not specified
CNA Linux Linux unaffected 2.6.26 semver Not specified
CNA Linux Linux unaffected 5.10.259 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.210 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.176 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.143 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.93 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.35 6.18.* semver Not specified
CNA Linux Linux unaffected 7.0.12 7.0.* semver Not specified
CNA Linux Linux unaffected 7.1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/90664556916de22467097d4c8ceb716d597a5c32 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9f9bfc80c67f35a275820da7e83a35dface08281 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ae03453f2c809ca3cf73753269fa6184dea7160f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/44f9bab8df7750a1e2a4d6cc22d7c9c2dc096aed 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/aaa66708bfb1dca2acd219d1c1582f9f6d5492cb 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/4a4cb0021ebe1fcadb52e04d19ed8d71470a530b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/be50533fe7068e86eb7adb81988e6d6a3f6dfe53 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/fcef31a5a85ccf3c313449a866ec6ed7e4132425 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report