CVE-2026-63899 Overview
CVE-2026-63899 is a memory corruption vulnerability in the Linux kernel USB serial mxuport driver. The driver failed to validate the bulk-out endpoint maximum packet size before using it in memory operations. A malicious USB device reporting a packet size smaller than eight bytes could trigger user-controlled slab corruption in kernel memory. The fix enforces a minimum bulk-out endpoint size of eight bytes during driver probe.
Critical Impact
A malicious or compromised USB device connected to a Linux system could corrupt kernel slab memory through the mxuport USB serial driver, potentially leading to kernel memory corruption and privilege escalation.
Affected Products
- Linux kernel builds including the USB serial mxuport driver
- Systems compiled with CONFIG_USB_SERIAL_MXUPORT enabled
- Stable kernel branches receiving the referenced backport commits
Discovery Timeline
- 2026-07-19 - CVE-2026-63899 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-63899
Vulnerability Analysis
The mxuport driver supports Moxa UPort USB-to-serial converters in the Linux kernel. During device probe, the driver reads the bulk-out endpoint descriptor supplied by the USB device and uses wMaxPacketSize to size internal buffers and command constructions. The driver assumed the endpoint reported a packet size of at least eight bytes, matching the minimum required for command framing.
A malicious USB device can advertise a wMaxPacketSize smaller than eight bytes. When the driver later writes command headers into a buffer sized from that value, the write exceeds the allocated slab object. The overflow contents are influenced by attacker-controlled descriptor fields, producing user-controlled slab corruption in kernel memory.
Root Cause
The root cause is missing input validation on USB descriptor data. The driver trusted the device-supplied endpoint wMaxPacketSize without enforcing a lower bound. The fix adds a size check ensuring the bulk-out endpoint is at least eight bytes and rejects the device otherwise. This maps to a boundary condition error in kernel driver initialization.
Attack Vector
Exploitation requires physical access or the ability to present a crafted USB device to the target system. The attacker programs a USB gadget or emulator to expose the Moxa vendor and product identifiers that bind to the mxuport driver. The gadget advertises a bulk-out endpoint with wMaxPacketSize under eight bytes. When the kernel enumerates the device, driver probe triggers the corruption without user interaction beyond device connection.
The vulnerability manifests in the mxuport probe path when handling attacker-supplied endpoint descriptors. See the referenced kernel commits including Linux Kernel Commit 086b858 for the exact patch diff.
Detection Methods for CVE-2026-63899
Indicators of Compromise
- Unexpected kernel oops, KASAN reports, or slab corruption warnings referencing the mxuport module in dmesg or /var/log/kern.log
- USB device connection events for Moxa UPort vendor and product IDs on hosts that do not normally use these adapters
- Kernel module load events for mxuport on systems with no legitimate Moxa serial hardware
Detection Strategies
- Monitor kernel logs for slab corruption signatures, SLUB errors, or general protection faults occurring shortly after USB enumeration
- Enable CONFIG_KASAN or CONFIG_SLUB_DEBUG on test systems to surface out-of-bounds writes during USB device probe
- Audit udev events and USB device add records to correlate driver binding with subsequent kernel instability
Monitoring Recommendations
- Deploy endpoint telemetry that captures USB device insertion metadata including vendor ID, product ID, and endpoint descriptors
- Alert on kernel module loads for niche USB serial drivers on production hosts where those drivers are not required
- Track kernel version inventory to identify hosts running builds that predate the patch commits
How to Mitigate CVE-2026-63899
Immediate Actions Required
- Update the Linux kernel to a stable release containing one of the referenced fix commits such as 086b858b5f5125bc9d967ea2bd825f83d9f8f29d or 2f3661eb2446e1ef593da45e01a3b21a906768ec
- On systems without a legitimate need for Moxa UPort adapters, blacklist the mxuport module to prevent automatic binding
- Enforce USB device control policies restricting which USB devices may be enumerated on sensitive endpoints and servers
Patch Information
The upstream fix adds a minimum size check for the bulk-out endpoint wMaxPacketSize in the mxuport probe routine. Backports are available across multiple stable branches. Reference commits: 086b858, 2f3661e, 4085f0d, 6c0cf56, b40166b, be3a1ed, ccbec56, and e906545.
Workarounds
- Blacklist the mxuport kernel module on hosts that do not require Moxa UPort serial adapter support
- Apply USB port lockdown through USBGuard or equivalent to allow only known-good devices to enumerate
- Restrict physical access to USB ports on servers, kiosks, and other unattended systems
# Blacklist the mxuport module until the kernel is patched
echo "blacklist mxuport" | sudo tee /etc/modprobe.d/blacklist-mxuport.conf
sudo update-initramfs -u
# Verify the module is not currently loaded
lsmod | grep mxuport
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
