CVE-2026-63957: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-63957 Overview

CVE-2026-63957 is a memory corruption vulnerability in the Linux kernel's safe_serial USB serial driver. The flaw exists in the bulk-out buffer handling when the driver operates in "safe" mode. A malicious USB device can advertise an endpoint with a bulk-out buffer size smaller than eight bytes, triggering user-controlled slab corruption in kernel memory. The upstream fix enforces a minimum buffer size of eight bytes before the driver processes data. This vulnerability affects Linux kernel builds that enable the USB_SERIAL_SAFE driver.

Critical Impact
A malicious USB device connected to a target system can corrupt kernel slab memory, potentially leading to kernel memory corruption, denial of service, or privilege escalation.

Affected Products

Linux kernel with CONFIG_USB_SERIAL_SAFE enabled
Multiple stable Linux kernel branches, as indicated by eight upstream stable-tree patches
Distributions shipping the affected safe_serial USB serial driver

Discovery Timeline

2026-07-19 - CVE-2026-63957 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63957

Vulnerability Analysis

The safe_serial driver implements a USB serial transport that wraps outgoing data in a framing structure. In "safe" mode, the driver reserves the last two bytes of each bulk-out packet for a length field and CRC, and expects additional header bytes. The driver did not validate that the bulk-out endpoint's maximum packet size was large enough to accommodate this framing overhead. When a USB device reports a bulk-out endpoint size smaller than eight bytes, subsequent write operations calculate a negative or undersized payload length. The driver then writes user-supplied data past the end of the allocated slab buffer, producing user-controlled heap corruption in the kernel's SLAB or SLUB allocator.

Root Cause

The root cause is missing input validation on USB endpoint metadata supplied by an untrusted device. The driver trusted the wMaxPacketSize value returned during USB enumeration without sanity-checking it against the minimum size required by the safe framing protocol. This class of flaw falls under improper input validation leading to heap-based memory corruption.

Attack Vector

An attacker requires physical access or the ability to attach a programmable USB device such as a Facedancer or Raspberry Pi Zero configured as a USB gadget. The malicious device enumerates as a USB serial peripheral supported by safe_serial and advertises a bulk-out endpoint with wMaxPacketSize below eight. When the host writes to the resulting /dev/ttyUSB* node, the crafted size triggers the out-of-bounds write. The attacker controls both the size mismatch and the payload contents, allowing targeted corruption of adjacent slab objects.

No verified exploit code is publicly available. The vulnerability mechanism is described in the upstream commit messages referenced in the Linux Kernel Patch 161ea0e5 and Linux Kernel Patch f793b67d.

Detection Methods for CVE-2026-63957

Indicators of Compromise

Kernel log entries referencing safe_serial binding to USB devices with unusually small bulk-out endpoint sizes
SLUB debug warnings, BUG: KASAN: slab-out-of-bounds reports, or general protection faults originating in safe_serial_write or nearby symbols
Unexpected USB device attachments identified as serial class devices on servers, workstations, or kiosks that should not accept peripherals

Detection Strategies

Enable CONFIG_KASAN on test and staging kernels to surface slab-out-of-bounds writes during triage of suspicious USB devices
Audit dmesg and journalctl -k for usb-serial binding events involving the safe driver, correlating VID/PID against an allow-list
Deploy USB device control policies that log and alert on newly enumerated USB serial devices, particularly on high-value endpoints

Monitoring Recommendations

Forward kernel logs and USB udev events to a centralized log platform for correlation and long-term retention
Monitor for kernel panics or oops events on Linux fleets and investigate any correlated with USB device insertion
Track loaded kernel modules and alert when safe_serial is autoloaded on systems that do not require it

How to Mitigate CVE-2026-63957

Immediate Actions Required

Apply the upstream stable-tree patches for your kernel branch, referenced by commits 161ea0e5, 438061ed, 857b3cc7, 9b3145b3, a550ed21, c7336c0f, e3a1d6ee, and f793b67d
Rebuild and redeploy kernels from your Linux distribution once vendor packages incorporating these commits are released
Restrict physical and logical USB access on servers, domain controllers, and other sensitive systems until patches are deployed

Patch Information

The fix adds a check that rejects the bulk-out endpoint if wMaxPacketSize is less than eight bytes, preventing the driver from binding to a malicious device. The patch is available across multiple stable kernel branches through the upstream commits listed above. Consult your distribution's security tracker for the specific kernel package version containing the backport.

Workarounds

Blacklist the safe_serial module by adding blacklist safe_serial to a file under /etc/modprobe.d/ if the driver is not required
Use USBGuard or a comparable USB device authorization framework to allow only known-good USB devices to enumerate
Disable USB ports in firmware or through physical port blockers on systems that do not require USB peripherals

bash

# Prevent the vulnerable driver from loading
echo 'blacklist safe_serial' | sudo tee /etc/modprobe.d/disable-safe-serial.conf
sudo modprobe -r safe_serial 2>/dev/null || true
sudo update-initramfs -u