CVE-2026-63900: Linux Kernel USB Keyspan Vulnerability

CVE-2026-63900 Overview

CVE-2026-63900 affects the Linux kernel's keyspan USB serial driver. The driver fails to validate the size of usa49wg indat transfers before parsing them. This missing sanity check allows the driver to read stale or uninitialized slab memory during transfer handling. The issue lives in the USB serial subsystem and has been resolved through multiple upstream stable branch commits.

Critical Impact
A malicious or malfunctioning USB device presenting itself as a Keyspan USA-49WG adapter can trigger the driver to parse uninitialized kernel slab data, potentially leading to information disclosure or memory corruption in the kernel USB serial path.

Affected Products

Linux kernel USB serial keyspan driver
Systems using Keyspan USA-49WG USB-to-serial adapters
Multiple stable kernel branches referenced in upstream patches

Discovery Timeline

2026-07-19 - CVE-2026-63900 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63900

Vulnerability Analysis

The keyspan driver handles USB-to-serial adapters manufactured by Keyspan. When processing incoming data (indat) callbacks from the usa49wg device variant, the driver dispatches URB completion handlers that consume the transfer buffer. The handler assumes the transfer contains a minimum amount of header and payload data.

Without a length check, the driver reads bytes past the actual transfer size. Because URB buffers are backed by slab allocations, out-of-bounds reads return either stale contents from previous allocations or uninitialized memory. The parsed values then influence downstream tty layer processing.

The fix adds an explicit length validation on the indat URB before parsing occurs. This aligns the usa49wg handler with sanity checks already present in sibling handlers within the same driver.

Root Cause

The root cause is missing input validation on USB transfer length within the usa49wg indat callback. The driver trusted the device to always deliver transfers of the expected minimum size. When a shorter transfer arrives, the callback proceeds to dereference offsets that fall outside the valid portion of the buffer, resulting in uninitialized memory use in a kernel slab allocation.

Attack Vector

Exploitation requires a USB device that identifies as a Keyspan USA-49WG adapter and sends undersized indat transfers. This can be achieved through physical USB attachment of a malicious device or through virtualized USB passthrough. The attack surface is limited to hosts with the keyspan driver auto-loaded and a matching device attached.

The vulnerability is described in prose only; no public exploit code is available. Refer to the upstream commits for the exact patch content, including Kernel Git Commit 0bde543 and Kernel Git Commit 3759a40.

Detection Methods for CVE-2026-63900

Indicators of Compromise

Unexpected attachment of USB devices claiming the Keyspan USA-49WG vendor and product identifiers on systems that do not use such adapters.
Kernel log entries from the keyspan driver showing malformed or short indat transfers.
KASAN or SLUB debug reports flagging use of uninitialized memory in keyspan_usa49_indat_callback code paths.

Detection Strategies

Enable kernel address sanitizer (KASAN) in test environments to catch out-of-bounds reads triggered by malformed USB transfers.
Audit USB device connection events through udev and auditd to identify unauthorized USB serial adapters.
Cross-reference running kernel versions against the patched commits listed in the NVD external references.

Monitoring Recommendations

Forward kernel ring buffer messages (dmesg) to a central log store and alert on keyspan driver warnings or oops traces.
Track USB device insertion telemetry on servers, workstations, and hypervisors where physical or virtual USB passthrough is permitted.
Include Linux kernel package version inventory in vulnerability management scans and flag hosts running unpatched stable branches.

How to Mitigate CVE-2026-63900

Immediate Actions Required

Update the Linux kernel to a version that includes the upstream sanity check commits referenced by NVD.
Restrict physical and virtual USB access on servers, hypervisors, and workstations that do not require USB-to-serial adapters.
Blacklist the keyspan kernel module on systems that do not use Keyspan hardware.

Patch Information

The fix has been applied across multiple stable kernel branches. Reference commits include Kernel Git Commit 0bde543, Kernel Git Commit 3759a40, Kernel Git Commit 41d9673, Kernel Git Commit ab8336a, Kernel Git Commit bd6c5fe, Kernel Git Commit e124120, Kernel Git Commit ea2b792, and Kernel Git Commit f7f566a. Apply the vendor-provided kernel update that corresponds to your distribution.

Workarounds

Prevent the keyspan module from loading by adding it to /etc/modprobe.d/blacklist.conf on hosts that do not require USB serial support.
Enable USBGuard or equivalent policy enforcement to allow only known USB device identifiers.
Disable USB passthrough in hypervisor configurations for guests that do not need serial adapter access.

bash

# Blacklist the keyspan driver on hosts that do not need it
echo "blacklist keyspan" | sudo tee /etc/modprobe.d/blacklist-keyspan.conf
sudo depmod -a
sudo update-initramfs -u