CVE-2026-63904: Linux Kernel USBTMC Buffer Overflow Flaw

CVE-2026-63904 Overview

CVE-2026-63904 is a Linux kernel vulnerability in the usb/usbtmc driver. USB Test and Measurement Class (USBTMC) devices can use an optional interrupt endpoint for notification messages. These notifications typically contain two-byte headers indicating the payload format. The driver did not verify that the URB actual_length was large enough to contain these headers before accessing the data buffers.

When the URB actual_length is smaller than the expected header size, the driver performs an out-of-bounds read or processes stale leftover data from a previous notification. The fix validates actual_data length and resubmits the URB to the interrupt endpoint when the buffer is too short.

Critical Impact
A malicious or malfunctioning USBTMC device can trigger an out-of-bounds read in the Linux kernel or cause the driver to act on stale notification data.

Affected Products

Linux kernel versions containing the usbtmc driver prior to the referenced stable commits
Systems using USB Test and Measurement Class devices with interrupt-IN endpoints
Distributions shipping affected upstream kernel branches (multiple stable trees patched)

Discovery Timeline

2026-07-19 - CVE-2026-63904 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63904

Vulnerability Analysis

The usbtmc driver supports an optional interrupt-IN endpoint used by USBTMC devices to deliver asynchronous notification messages. Each notification is expected to begin with a two-byte header describing the payload format followed by any additional payload data. The driver's completion path accesses these header bytes and downstream buffer contents without first validating the URB actual_length field returned by the USB core.

When a device returns a short transfer, the buffer contains fewer bytes than the driver assumes. Reading past actual_length results in an out-of-bounds read into adjacent kernel memory. Alternatively, because URB buffers are reused across transfers, the driver may consume stale leftover data from a previous notification and treat it as valid header content. This leads to incorrect notification dispatch and potential information exposure through kernel memory contents.

The issue is classified as an out-of-bounds read [CWE-125] in kernel space triggered through USB device behavior.

Root Cause

The root cause is missing input validation of the URB actual_length value in the interrupt-IN completion handler. The driver assumed all received notifications contained at least the two-byte header, but the USB stack can deliver short transfers when a device misbehaves or is crafted to do so. Without a length check, subsequent buffer accesses proceed unconditionally.

Attack Vector

Exploitation requires a USBTMC device or an emulated USB device attached to the target system that returns short interrupt-IN transfers. Physical access or the ability to introduce a malicious USB peripheral is required. The vulnerability does not offer a network attack vector. Successful triggering exposes kernel memory contents through subsequent driver behavior or induces incorrect notification handling logic.

No verified public exploit code is available. Refer to the upstream stable commits listed in Kernel Git Commit Fix and companion commits for the exact source-level changes.

Detection Methods for CVE-2026-63904

Indicators of Compromise

Unexpected kernel log messages from the usbtmc driver referencing malformed notifications or short transfers
Presence of unknown or unauthorized USBTMC-class devices in dmesg or lsusb output
KASAN or kernel memory sanitizer reports flagging out-of-bounds reads inside usbtmc completion handlers

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test systems to identify out-of-bounds reads in the usbtmc driver
Audit connected USB devices for unexpected interface class 0xFE (application-specific) with USBTMC subclass
Correlate USB device connection events with kernel warning messages produced by driver instrumentation

Monitoring Recommendations

Forward kernel logs and USB subsystem events to a centralized logging platform for review
Alert on connection of USBTMC-class devices to servers, workstations, and lab systems where they are not expected
Track kernel version inventory across the fleet to prioritize hosts running unpatched kernels

How to Mitigate CVE-2026-63904

Immediate Actions Required

Update to a Linux kernel version that includes the referenced stable commits for the usbtmc driver fix
Restrict physical access to production systems and limit which USB peripherals can be attached
Disable or blacklist the usbtmc kernel module on systems that do not require Test and Measurement device support

Patch Information

The fix adds a length check in the interrupt-IN completion path. If the URB actual_length is less than the required header size, the driver resubmits the URB instead of accessing the buffer contents. The patch is applied across multiple stable branches. Relevant commits include Kernel Git Commit Patch, Kernel Git Commit Fix, Kernel Git Commit Improvement, Kernel Git Commit Revision, Kernel Git Commit Update, Kernel Git Commit Update, Kernel Git Commit Change, and Kernel Git Commit Adjustment.

Workarounds

Blacklist the usbtmc module on hosts that do not require USB Test and Measurement Class support
Enforce USB device authorization policies using kernel USB authorization or usbguard to allow only approved devices
Physically restrict USB port access on affected systems until patched kernels are deployed

bash

# Blacklist the usbtmc module on systems that do not require it
echo "blacklist usbtmc" | sudo tee /etc/modprobe.d/blacklist-usbtmc.conf
sudo rmmod usbtmc 2>/dev/null
sudo update-initramfs -u

# Verify the module is not loaded
lsmod | grep usbtmc