CVE-2026-63901: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-63901 Overview

CVE-2026-63901 is a memory corruption vulnerability in the Linux kernel's digi_acceleport USB serial driver. The flaw stems from missing bulk-out buffer size sanity checks in the driver's endpoint handling code. A malicious USB device can report smaller buffers than the driver expects, triggering out-of-bounds memory accesses or slab corruption in kernel memory. The issue was resolved upstream through multiple stable kernel commits distributed across supported branches.

Critical Impact
A crafted USB device physically connected to a vulnerable Linux system can corrupt kernel slab memory, potentially leading to denial of service or memory-corruption-based privilege escalation.

Affected Products

Linux kernel — drivers/usb/serial/digi_acceleport.c USB serial driver
Multiple stable kernel branches referenced in the upstream fix commits
Systems that load the digi_acceleport module and accept USB serial devices

Discovery Timeline

2026-07-19 - CVE-2026-63901 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63901

Vulnerability Analysis

The digi_acceleport driver provides support for Digi AccelePort USB serial adapters. During device probing, the driver reads bulk-out endpoint descriptors reported by the attached USB device. The driver then uses those buffer sizes when allocating and writing to internal transfer buffers. Without a sanity check confirming the endpoint's reported buffer size meets the driver's minimum expectations, subsequent write operations exceed the actual buffer allocation.

The result is either an out-of-bounds write into adjacent kernel slab memory or corruption of neighboring slab objects. Both outcomes are exploitable memory safety conditions in kernel context. Attacks require physical or virtual USB attachment, so the attack vector is local and requires device access, but no user authentication is needed if the host auto-binds USB serial drivers.

Root Cause

The root cause is missing input validation on USB endpoint descriptor fields. The driver trusts the wMaxPacketSize reported by the device without confirming it meets the size the driver requires for its bulk-out operations. This is a classic Out-of-Bounds Write [CWE-787] pattern triggered by attacker-controlled hardware metadata.

Attack Vector

An attacker connects a malicious or emulated USB device that identifies itself as a Digi AccelePort adapter but advertises undersized bulk-out endpoint buffers. When the kernel binds the digi_acceleport driver and the driver later issues writes sized according to its own assumptions, the write overflows the smaller buffer. Depending on slab layout, this can corrupt adjacent kernel objects. The upstream patch adds the missing size checks and refuses to bind if the reported buffer sizes are insufficient.

No public proof-of-concept code is available for this CVE. Technical details of the fix can be reviewed in the upstream commits, including Kernel Git Commit 062dcc0b and Kernel Git Commit 41b645e7.

Detection Methods for CVE-2026-63901

Indicators of Compromise

Kernel oops, panic, or slab-out-of-bounds messages in dmesg referencing digi_acceleport or usb_serial.
KASAN reports flagging out-of-bounds writes originating from the digi_acceleport module on kernels built with KASAN.
Unexpected loading of the digi_acceleport module on systems that do not use Digi USB serial hardware.

Detection Strategies

Audit installed kernel versions against the fixed versions referenced in the stable-tree commits and flag hosts still running vulnerable builds.
Enable USB device authorization policies and log udev events for new USB serial device attachments, especially those matching Digi vendor/product identifiers.
Monitor kernel logs centrally for driver bind failures, slab corruption warnings, and module load events for digi_acceleport.

Monitoring Recommendations

Ship dmesg, journald, and auditd USB events to a centralized log platform and alert on kernel memory corruption signatures.
Track USB device enumeration on servers and workstations where physical access is possible, including virtualized hosts that expose USB passthrough.
Correlate new-module-load telemetry with user session and physical access records to identify anomalous USB serial adapter attachments.

How to Mitigate CVE-2026-63901

Immediate Actions Required

Apply the latest stable Linux kernel update for your distribution that includes the digi_acceleport endpoint size checks.
Blacklist the digi_acceleport module on systems that do not require Digi USB serial adapters using modprobe blacklist configuration.
Restrict physical and virtual USB access on servers, kiosks, and shared workstations, and disable USB passthrough for untrusted virtual machines.

Patch Information

The fix adds bulk-out buffer size sanity checks in the digi_acceleport driver so the kernel rejects endpoints reporting insufficient buffer sizes. The patch has been merged into multiple stable branches. Relevant commits include 062dcc0b, 25b93d0f, 41b645e7, 6ab1e9ae, 8a65db5e, 9469419b, cb3560e8, and fd34198c.

Workarounds

Blacklist the vulnerable driver where it is not needed by adding blacklist digi_acceleport to /etc/modprobe.d/ and regenerating initramfs.
Enforce USBGuard or equivalent policy to allow only known-good USB devices to bind to kernel drivers.
Disable unused USB ports in BIOS/UEFI on high-value systems where physical attack surface reduction is feasible.

bash

# Configuration example: prevent the vulnerable driver from loading
echo 'blacklist digi_acceleport' | sudo tee /etc/modprobe.d/blacklist-digi_acceleport.conf
sudo update-initramfs -u
sudo modprobe -r digi_acceleport 2>/dev/null || true