CVE-2026-63897: Linux Kernel Information Disclosure Bug

CVE-2026-63897 Overview

CVE-2026-63897 is a Linux kernel vulnerability in the mct_u232 USB serial driver. The driver failed to validate the size of interrupt-in URB transfers before parsing them. As a result, the driver could read stale or uninitialized slab memory and forward that data to user space. The issue falls under uninitialized memory use and information disclosure categories [CWE-908, CWE-200]. Maintainers resolved the flaw by adding the missing sanity check on interrupt-in transfer size in the mct_u232 USB serial driver.

Critical Impact
A malicious or malformed USB device presenting itself as a Magic Control Technology U232 serial adapter can trigger the kernel to leak uninitialized slab memory contents to user space.

Affected Products

Linux kernel with the drivers/usb/serial/mct_u232.c driver enabled
Multiple stable kernel branches referenced by upstream fix commits
Systems that load the mct_u232 module for USB-to-serial adapters based on the MCT U232 chipset

Discovery Timeline

2026-07-19 - CVE-2026-63897 published to the National Vulnerability Database
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63897

Vulnerability Analysis

The mct_u232 driver supports Magic Control Technology U232 USB-to-serial converters. The driver registers an interrupt-in URB completion handler that parses status bytes returned by the device. Before the fix, the completion handler processed the URB buffer without confirming that the transferred length was sufficient to hold the expected status structure.

When a device returned a short interrupt-in transfer, or when the URB was completed with an unexpected length, the driver still dereferenced bytes beyond the valid transferred region. Those bytes came from a slab-allocated buffer that may retain residual data from prior allocations. The driver then propagated parsed values, including modem status bits, into fields exposed to user space through the tty interface.

Root Cause

The root cause is a missing length check on urb->actual_length in the interrupt-in completion path of mct_u232. Without the guard, the code parses whatever the URB buffer contains, including uninitialized kernel heap memory. This maps to CWE-908: Use of Uninitialized Resource and CWE-200: Exposure of Sensitive Information.

Attack Vector

Exploitation requires the ability to attach or emulate a USB device that binds to the mct_u232 driver. A crafted device can complete interrupt-in URBs with truncated payloads, causing the driver to parse uninitialized slab bytes. An attacker with physical USB access, or control of a USB-over-IP endpoint, can repeatedly trigger the completion path to sample kernel heap contents. See the Linux Kernel Commit 245aba8 for the corrected boundary check.

No verified public exploit code is available for this issue. The vulnerability is described in prose based on the upstream commit messages.

Detection Methods for CVE-2026-63897

Indicators of Compromise

Unexpected loading of the mct_u232 kernel module on systems that do not use MCT U232 USB-to-serial adapters
Kernel log entries from the USB serial subsystem referencing short or malformed interrupt-in transfers on ttyUSB devices
Attachment of unknown USB devices identifying with vendor and product IDs claimed by MCT U232 adapters

Detection Strategies

Audit dmesg and journalctl -k output for mct_u232 binding events and correlate them with the physical or virtual USB topology
Monitor /sys/bus/usb/devices/ for new device enumerations that trigger USB serial driver binding on servers and workstations
Use USB device allowlisting via usbguard to detect and block unauthorized USB serial adapters

Monitoring Recommendations

Forward kernel USB subsystem logs to a centralized log platform and alert on unexpected USB serial driver loads
Track kernel package versions across the fleet and flag hosts running kernels that predate the fix commits referenced by upstream stable branches
Alert on user-space processes reading from ttyUSB* devices on systems where USB-to-serial adapters are not part of the approved hardware baseline

How to Mitigate CVE-2026-63897

Immediate Actions Required

Update to a Linux kernel release that includes the mct_u232 interrupt-in sanity check fix from the referenced upstream commits
Restrict physical access to USB ports on production systems and enforce USB device policies with usbguard or equivalent controls
Blacklist the mct_u232 module on hosts that do not require MCT U232 USB-to-serial functionality

Patch Information

The fix is committed to the mainline Linux kernel and backported to multiple stable branches. Relevant upstream commits include 245aba8, 631b8b7, 70bb9a2, 82b48d7, 8b93ee5, a093f3e, ed260b5, and f06bcab. Apply the distribution kernel update that carries these commits.

Workarounds

Blacklist the mct_u232 module by adding blacklist mct_u232 to a file under /etc/modprobe.d/ and rebuilding the initramfs
Deploy USB device authorization policies to prevent binding of untrusted USB serial adapters
Disable USB ports at the firmware or endpoint policy layer on systems that do not require USB peripherals

bash

# Configuration example
# Prevent the vulnerable driver from loading
echo 'blacklist mct_u232' | sudo tee /etc/modprobe.d/blacklist-mct_u232.conf
sudo update-initramfs -u

# Verify the module is not currently loaded
lsmod | grep mct_u232

# Optional: unload if present
sudo modprobe -r mct_u232