CVE-2026-63902: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-63902 Overview

CVE-2026-63902 is an out-of-bounds read vulnerability in the Linux kernel's USB serial driver for Cypress M8 devices. The flaw resides in cypress_read_int_callback() within drivers/usb/serial/cypress_m8.c, which parses interrupt-in buffers based on the selected Cypress packet format. When a short USB interrupt transfer completes with fewer bytes than the expected header length, the callback reads header bytes past the valid data region. A KASAN report confirmed a slab-out-of-bounds read of size 1 during the callback path invoked via __usb_hcd_giveback_urb(). The vulnerability has been resolved upstream by validating that the completed packet contains the selected header before reading it.

Critical Impact
A malicious or malfunctioning USB device presenting as a Cypress M8 serial adapter can trigger kernel out-of-bounds memory reads, potentially causing information disclosure or kernel instability.

Affected Products

Linux kernel USB serial subsystem (drivers/usb/serial/cypress_m8.c)
Systems using Cypress M8-based USB-to-serial adapters
Multiple stable kernel branches (see referenced git commits)

Discovery Timeline

2026-07-19 - CVE-2026-63902 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63902

Vulnerability Analysis

The cypress_m8 USB serial driver supports two interrupt packet formats. Format 1 uses a two-byte status/count header, while format 2 uses a one-byte combined status/count header. The cypress_read_int_callback() function parses these headers from the interrupt-in buffer that the usb-serial core sizes according to the endpoint descriptor's wMaxPacketSize. The driver's callback assumed the buffer always contained at least the header bytes for the selected format.

This assumption fails because USB interrupt transfers can complete short when the URB_SHORT_NOT_OK flag is not set. A device may return fewer bytes than the expected header length, but the callback proceeded to dereference header bytes without checking the actual actual_length of the URB. The result is a slab-out-of-bounds read reported by Kernel Address Sanitizer (KASAN) at cypress_read_int_callback+0x240/0x7f0.

Root Cause

The root cause is missing input validation on USB transfer length. The driver trusted that a successful URB completion contained the full expected packet, but short reads are permitted by the USB core. This is an Out-of-Bounds Read caused by improper input validation on device-controlled data.

Attack Vector

Exploitation requires a USB device that enumerates as a Cypress M8 serial adapter and returns short interrupt-in packets. The attack requires physical access or a malicious USB device that the victim connects. Once connected, the device can cause the kernel to read beyond the allocated interrupt-in buffer, potentially leaking adjacent slab memory contents or triggering KASAN-detected memory corruption in hardened builds.

No synthetic exploitation code is provided. The upstream patches referenced below add explicit length checks against the selected header size and ignore malformed short reports, resubmitting the interrupt URB through the existing retry path.

Detection Methods for CVE-2026-63902

Indicators of Compromise

KASAN reports referencing cypress_read_int_callback with slab-out-of-bounds in kernel logs
Unexpected kernel oops or warnings originating from drivers/usb/serial/cypress_m8.c
Enumeration of unknown or spoofed Cypress M8 USB serial devices in dmesg output

Detection Strategies

Monitor kernel ring buffer (dmesg) and /var/log/kern.log for KASAN out-of-bounds messages tied to the cypress_m8 driver
Audit USB device attachment events via udev and correlate with unexpected serial adapter enumeration
Enable KASAN in test and staging kernels to surface out-of-bounds reads before production deployment

Monitoring Recommendations

Track kernel version and cypress_m8 module state across Linux fleet inventory
Log USB device connect and disconnect events centrally for forensic review
Alert on any kernel crash or WARN traces referencing usb-serial callbacks

How to Mitigate CVE-2026-63902

Immediate Actions Required

Update to a Linux kernel release that includes the upstream fixes referenced by the git commits below
Restrict physical USB access on sensitive systems and enforce USB device authorization policies
Unload the cypress_m8 module on systems that do not require Cypress USB-to-serial devices

Patch Information

The fix validates that the completed interrupt-in packet contains at least the selected header length before reading it, using named constants for header sizes. Malformed short reports are ignored and the interrupt URB is resubmitted through the existing retry path. Refer to the upstream commits: Kernel Git Commit 44f9bab8, Kernel Git Commit 4a4cb002, Kernel Git Commit 90664556, Kernel Git Commit 9f9bfc80, Kernel Git Commit aaa66708, Kernel Git Commit ae03453f, Kernel Git Commit be50533f, and Kernel Git Commit fcef31a5.

Workarounds

Blacklist the cypress_m8 kernel module on hosts that do not need Cypress USB serial support
Use USBGuard or equivalent to allowlist only trusted USB device IDs
Disable unused USB ports via BIOS/UEFI or kernel parameters on high-value systems

bash

# Configuration example: blacklist the cypress_m8 module
echo "blacklist cypress_m8" | sudo tee /etc/modprobe.d/blacklist-cypress_m8.conf
sudo rmmod cypress_m8 2>/dev/null
sudo update-initramfs -u