CVE-2026-63898: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-63898 Overview

CVE-2026-63898 is a memory corruption vulnerability in the Linux kernel's mct_u232 USB serial driver. The driver overrides the maximum transfer size for a specific USB-to-serial device that only accepts 16-byte packets on its 32-byte bulk-out endpoint. When a malicious USB device reports a smaller endpoint max packet size than expected, the driver can increase the maximum transfer size beyond safe bounds. This results in slab corruption in kernel memory. The issue has been resolved upstream by ensuring the driver never increases the maximum transfer size.

Critical Impact
A malicious or malformed USB device attached to a Linux host can trigger kernel slab corruption through the mct_u232 driver, leading to denial of service or potential kernel memory corruption.

Affected Products

Linux kernel versions containing the mct_u232 USB serial driver prior to the patched commits
Distributions shipping vulnerable stable kernel branches (multiple stable trees received backports)
Systems where the mct_u232 module can be autoloaded on USB device insertion

Discovery Timeline

2026-07-19 - CVE-2026-63898 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63898

Vulnerability Analysis

The mct_u232 driver supports Magic Control Technology USB-to-RS232 converters. For one particular device model, the driver overrides the default maximum transfer size because the hardware only accepts 16-byte packets even though its bulk-out endpoint advertises a 32-byte maximum packet size.

The override logic did not clamp the resulting transfer size to the endpoint's advertised maximum. A malicious USB device can declare a smaller wMaxPacketSize than the driver expects. The driver then computes a transfer size larger than the actual allocated buffer, producing an out-of-bounds write into adjacent slab memory during URB submission.

This class of bug falls under kernel memory corruption in USB driver code, an area repeatedly targeted by physical-access attack tooling and fuzzing frameworks such as syzkaller.

Root Cause

The root cause is missing validation when the driver adjusts its transfer size. The device-specific override unconditionally set the transfer size without confirming it does not exceed the endpoint's actual wMaxPacketSize. When a device reports a lower value than anticipated, the buffer allocated based on the endpoint size is smaller than the transfer size the driver believes it is working with, resulting in slab corruption.

Attack Vector

Exploitation requires an attacker-controlled USB device. The attacker crafts USB descriptors that identify the device as a Magic Control Technology adapter while advertising a bulk-out endpoint with a wMaxPacketSize smaller than 32 bytes. When plugged into a Linux host that autoloads mct_u232, the driver initializes with the malicious endpoint sizing and subsequent URB traffic corrupts kernel slab memory.

The vulnerability manifests during driver probe and I/O submission. See the referenced upstream commits (39e295a, 57f332a, 6cb48f8, 90dbad1, 915b36d, 94edbbc, bd2ddb3, d8fdf33) for the exact code paths involved.

Detection Methods for CVE-2026-63898

Indicators of Compromise

Kernel oops or panic messages referencing mct_u232, usb_serial, or slab allocator functions such as kmalloc, kfree, or SLUB corruption reports in dmesg
KASAN reports flagging out-of-bounds writes originating from mct_u232 URB completion paths
Unexpected USB device enumeration events for vendor/product IDs matching Magic Control Technology adapters on hosts that should not have such devices attached

Detection Strategies

Monitor kernel logs for mct_u232 module load events correlated with USB attachment on systems where serial adapters are not expected
Deploy kernel builds with KASAN or SLUB debugging enabled in test environments to catch slab corruption triggered by test USB fuzzing harnesses
Track USB descriptor anomalies where reported endpoint wMaxPacketSize values deviate from vendor specifications

Monitoring Recommendations

Enable USB device authorization policies (/sys/bus/usb/devices/.../authorized) and log unauthorized attachment attempts
Aggregate dmesg and journald USB subsystem events into a central log platform for correlation and alerting
Alert on kernel taint flag changes, particularly T (taint after machine check) or D (die notification) events following USB insertion

How to Mitigate CVE-2026-63898

Immediate Actions Required

Update to a kernel version that includes the upstream fixes referenced in the linked stable commits
Restrict physical access to production Linux systems to reduce the risk of malicious USB device insertion
Where hot-plug serial adapters are not required, blacklist the mct_u232 module using /etc/modprobe.d/ to prevent autoload

Patch Information

The fix ensures the driver never increases the maximum transfer size when applying the device-specific override. Patches are available in the following upstream commits: 39e295a, 57f332a, 6cb48f8, 90dbad1, 915b36d, 94edbbc, bd2ddb3, and d8fdf33. Consult your Linux distribution's security advisories to identify the specific package version containing the backport.

Workarounds

Blacklist the mct_u232 kernel module on systems that do not require Magic Control Technology USB-to-serial adapters
Enable USBGuard or equivalent USB device authorization frameworks to allow only known-good USB device IDs
Disable USB ports in firmware or via kernel command-line parameters on high-security systems where USB peripherals are not needed

bash

# Configuration example
# Blacklist the vulnerable driver until patches are applied
echo 'blacklist mct_u232' | sudo tee /etc/modprobe.d/blacklist-mct_u232.conf
sudo depmod -a
sudo update-initramfs -u

# Verify the module is not currently loaded
lsmod | grep mct_u232

# Optional: enforce USB device allowlisting with USBGuard
sudo apt install usbguard
sudo usbguard generate-policy > /etc/usbguard/rules.conf
sudo systemctl enable --now usbguard