CVE-2026-63897

USB: serial: mct_u232: fix missing interrupt-in transfer sanity check

MEDIUM

5.5

CVSS Score

Published: July 19, 2026 at 02:55 PM UTC

Updated: October 30, 2026 at 02:38 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Add the missing sanity check on the size of interrupt-in transfers to avoid parsing stale or uninitialised slab data (and leaking it to user space).

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

2.6.12.1 ≤ v < 5.10.2595.11 ≤ v < 5.15.2105.16 ≤ v < 6.1.1766.13 ≤ v < 6.18.356.19 ≤ v < 7.0.126.2 ≤ v < 6.6.1436.7 ≤ v < 6.12.931da177e4c3f41524e886b7f1b8a0c1fc7321cac2 2.6.12 7.1

Vendor states this is fixed in 245aba83e3c288e176ed037a1f6b618b09e92ed8 (fixed)

Vendor states this is fixed in 631b8b7c456567f7a8d26f6fc354c8dd9cc9f832 (fixed)

Vendor states this is fixed in 70bb9a2661d34b93a9b83cf83e2b76289a712ef0 (fixed)

Vendor states this is fixed in 82b48d70bced1ec8e5f676d1fd5eccc7a44dc418 (fixed)

Vendor states this is fixed in 8b93ee5baeef6efabee2c3381907733ad2dbc883 (fixed)

Vendor states this is fixed in a093f3e0c03d25a86d747a655d4b9322ffb2ed87 (fixed)

Vendor states this is fixed in ed260b56bc9fc878e5dcbb866eab8af0688e0e67 (fixed)

Vendor states this is fixed in f06bcaba29707f060706483b2020d3cafbe98f9f (fixed)

Vendor states this is fixed in 2.6.12 (unaffected)

Vendor states this is fixed in 5.10.259 (unaffected)

Vendor states this is fixed in 5.15.210 (unaffected)

Vendor states this is fixed in 6.1.176 (unaffected)