CVE-2026-63903: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-63903 Overview

CVE-2026-63903 is an out-of-bounds read vulnerability in the Linux kernel's Belkin USB serial driver (drivers/usb/serial/belkin_sa.c). The belkin_sa_read_int_callback() function treats incoming interrupt data as a four-byte status report and reads Line Status Register (LSR) and Modem Status Register (MSR) fields at offsets 2 and 3. The driver derives the interrupt-in buffer length from the endpoint's wMaxPacketSize but does not validate the actual_length of short interrupt transfers. Short successful packets cause the callback to read past the valid data, producing slab-out-of-bounds reads detected by Kernel Address Sanitizer (KASAN).

Critical Impact
A malicious or malformed USB device presenting a Belkin serial interface can trigger out-of-bounds kernel memory reads, potentially leaking stale slab data or causing kernel instability.

Affected Products

Linux kernel versions containing the vulnerable belkin_sa USB serial driver prior to the fix
Systems using Belkin USB-to-serial adapters via the belkin_sa driver
Distributions shipping affected stable kernel branches referenced in the upstream commits

Discovery Timeline

2026-07-19 - CVE-2026-63903 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63903

Vulnerability Analysis

The vulnerability resides in the interrupt completion callback belkin_sa_read_int_callback() in drivers/usb/serial/belkin_sa.c. The callback assumes the interrupt URB carries at least four bytes of status information and unconditionally dereferences bytes at offsets 2 and 3 to extract LSR and MSR values. When a device completes an interrupt transfer with a smaller actual_length, or when the endpoint reports a wMaxPacketSize smaller than four bytes, the accesses read beyond the initialized portion of the interrupt-in buffer.

KASAN reports the issue as a slab-out-of-bounds read of size 1 during URB completion, with the call chain traversing __usb_hcd_giveback_urb() into the driver callback. The read can return stale slab contents from adjacent allocations, exposing kernel memory to interpretation as serial status flags.

Root Cause

The root cause is missing validation of the completed interrupt packet length before parsing status fields. The driver trusts the endpoint's advertised wMaxPacketSize as an implicit lower bound and does not compare urb->actual_length against the required four-byte header. Short interrupt endpoints and short successful transfers therefore bypass the implicit size assumption.

Attack Vector

An attacker with physical access can attach a crafted USB device that identifies as a Belkin serial adapter and completes interrupt transfers with fewer than four bytes. Alternatively, a malfunctioning genuine device that produces short interrupt packets can trigger the same condition. The vulnerability is exploited at URB completion time in kernel context, without requiring authenticated userspace access.

Because no verified proof-of-concept has been released, this section describes the mechanism in prose. Refer to the upstream fix commits listed in kernel.org stable commits for the exact patch content.

Detection Methods for CVE-2026-63903

Indicators of Compromise

KASAN reports referencing belkin_sa_read_int_callback with slab-out-of-bounds in kernel logs
Unexpected belkin_sa driver binding events for previously unseen USB vendor/product identifiers
Kernel oops or warnings originating from __usb_hcd_giveback_urb() on systems with USB serial adapters attached

Detection Strategies

Enable KASAN in test or canary kernels to surface out-of-bounds reads in the USB serial subsystem during device enumeration
Audit dmesg and journald logs for messages from drivers/usb/serial/belkin_sa.c at or near URB completion paths
Correlate USB device attach events (udev) with subsequent kernel warnings to flag anomalous adapter behavior

Monitoring Recommendations

Aggregate kernel ring buffer output through a central log pipeline and alert on KASAN or slab-out-of-bounds strings
Track installed kernel package versions against the upstream stable commits that carry the fix
Monitor USB device connection events on servers and workstations where untrusted physical access is possible

How to Mitigate CVE-2026-63903

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits (for example f361359a952d and related backports) or upgrade to a distribution kernel that includes the fix
Restrict physical USB access on multi-user or exposed systems and enforce USB device authorization policies
Unload the belkin_sa module on systems that do not require Belkin USB serial adapters using modprobe -r belkin_sa and blacklist it

Patch Information

The fix adds a length check on the completed interrupt packet before parsing LSR and MSR fields, so short interrupt endpoints and short successful packets are ignored. Backports are available across multiple stable branches. See the following commits: 22823a319fb2, 37e54d1b986d, 4ce058df2ee0, 6a4602221cba, db1e7eb6203d, f1617539ab90, f361359a952d, and ffb739a49186.

Workarounds

Blacklist the belkin_sa kernel module on systems that do not use Belkin USB-to-serial hardware
Enable USB device authorization (/sys/bus/usb/devices/.../authorized) to require explicit approval before binding drivers
Deploy USBGuard or equivalent policy tooling to allowlist trusted USB devices only

bash

# Blacklist the vulnerable driver until the kernel is patched
echo 'blacklist belkin_sa' | sudo tee /etc/modprobe.d/blacklist-belkin_sa.conf
sudo modprobe -r belkin_sa 2>/dev/null || true

# Require explicit authorization for new USB devices on a given host controller
for hc in /sys/bus/usb/devices/usb*/authorized_default; do
    echo 0 | sudo tee "$hc"
done