CVE-2026-63956 Overview
CVE-2026-63956 is a memory corruption vulnerability in the Linux kernel's cypress_m8 USB serial driver. The flaw occurs when the driver processes an interrupt-out endpoint with a maximum packet size smaller than eight bytes. A malicious USB device can report a small endpoint size to trigger user-controlled slab corruption or a NULL-pointer dereference in kernel memory. The upstream fix validates that the interrupt-out endpoint wMaxPacketSize is at least eight bytes before use. Exploitation requires physical access or the ability to attach a crafted USB device to the target host.
Critical Impact
A malicious USB device can corrupt kernel slab memory or trigger a NULL-pointer dereference, resulting in kernel crash or potential local privilege escalation.
Affected Products
- Linux kernel — drivers/usb/serial/cypress_m8.c
- Distributions shipping the cypress_m8 USB serial driver
- Systems with USB ports exposed to untrusted peripherals
Discovery Timeline
- 2026-07-19 - CVE-2026-63956 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-63956
Vulnerability Analysis
The cypress_m8 driver supports Cypress M8 family USB-to-serial bridge chips. During device probe and write-path handling, the driver uses the interrupt-out endpoint's wMaxPacketSize to size write buffers and construct outbound URBs. The driver assumed the endpoint reports at least eight bytes, matching the protocol's minimum packet layout for control and data framing.
When a USB device advertises an interrupt-out endpoint with a smaller wMaxPacketSize, the driver writes past the allocated slab object or dereferences pointers derived from truncated buffers. The corruption is user-controlled because the attacker chooses the endpoint descriptor and the data written to the serial port. The fix adds a length check that rejects endpoints below the required minimum.
Root Cause
The root cause is missing validation of USB descriptor fields supplied by the peripheral. The driver trusted wMaxPacketSize from the device without verifying it met the driver's minimum protocol requirement, a class of bug tracked as improper input validation on hardware-supplied data.
Attack Vector
An attacker with the ability to plug a malicious or emulated USB device into a target machine crafts a device descriptor advertising an interrupt-out endpoint with wMaxPacketSize below eight. When the kernel binds cypress_m8 to the device and userspace writes to the resulting /dev/ttyUSB* node, the driver corrupts kernel memory. Attack scenarios include unattended workstations, kiosks, servers with USB ports exposed, and virtualized guests receiving passed-through USB devices.
No synthetic proof-of-concept is published for this CVE. Refer to the upstream commit references for the exact code path and fix.
Detection Methods for CVE-2026-63956
Indicators of Compromise
- Kernel oops or panic messages referencing cypress_m8, usb_serial, or slab corruption warnings in dmesg and /var/log/kern.log
- SLUB debug output such as Redzone overwritten or Freepointer corrupt near usb_serial_write frames
- Unexpected USB device enumeration events for vendor/product IDs handled by cypress_m8 on hosts that do not normally use such adapters
Detection Strategies
- Enable CONFIG_SLUB_DEBUG and KASAN on test systems to surface out-of-bounds writes during USB fuzzing
- Audit udev and kernel logs for cypress_m8 bind events correlated with kernel warnings
- Deploy USB device allow-listing (for example, USBGuard) and alert when unknown descriptors appear
Monitoring Recommendations
- Forward kernel ring buffer and audit logs to a central store and alert on BUG:, Oops:, and general protection fault patterns
- Track USB attach events on servers, jump hosts, and endpoints in sensitive network segments
- Correlate device insertion with subsequent process crashes or reboots on the same host
How to Mitigate CVE-2026-63956
Immediate Actions Required
- Apply the upstream kernel patches referenced in the stable tree commits and rebuild or update to a fixed distribution kernel
- Disable or blacklist the cypress_m8 module on systems that do not require Cypress USB-to-serial adapters using echo "blacklist cypress_m8" > /etc/modprobe.d/cypress_m8.conf
- Restrict physical access to USB ports on servers and shared workstations
Patch Information
The fix is merged across multiple stable branches. See the upstream commits: Linux Kernel Commit 1ef25704, Commit 284105c4, Commit 4bcaa59f, Commit 4fcb2221, Commit 52e18ae0, Commit 6c13f3bb, Commit ad3d1628, and Commit e1a9d791. The patch adds a check that returns an error when the interrupt-out endpoint wMaxPacketSize is less than eight bytes.
Workarounds
- Blacklist the cypress_m8 module where the driver is not required
- Enforce USB device policy with USBGuard to allow only known vendor and product identifiers
- Enable kernel lockdown and disable automatic module loading for USB serial drivers on high-value hosts
# Blacklist the vulnerable driver and enforce USB allow-listing
echo "blacklist cypress_m8" | sudo tee /etc/modprobe.d/cypress_m8.conf
sudo depmod -a
sudo modprobe -r cypress_m8 2>/dev/null || true
# Install and enable USBGuard with a policy generated from currently trusted devices
sudo apt install -y usbguard
sudo usbguard generate-policy | sudo tee /etc/usbguard/rules.conf
sudo systemctl enable --now usbguard
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
