CVE-2026-63898

USB: serial: mct_u232: fix memory corruption with small endpoint

HIGH

7.8

CVSS Score

Published: July 19, 2026 at 02:55 PM UTC

Updated: October 30, 2026 at 02:38 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mct_u232: fix memory corruption with small endpoint The driver overrides the maximum transfer size for a specific device which only accepts 16 byte packets for its 32 byte bulk-out endpoint. Make sure to never increase the maximum transfer size to prevent slab corruption should a malicious device report a smaller endpoint max packet size than expected.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

2.6.12.1 ≤ v < 5.10.2595.11 ≤ v < 5.15.2105.16 ≤ v < 6.1.1766.13 ≤ v < 6.18.356.19 ≤ v < 7.0.126.2 ≤ v < 6.6.1436.7 ≤ v < 6.12.941da177e4c3f41524e886b7f1b8a0c1fc7321cac2 2.6.12 7.1

Vendor states this is fixed in 39e295a91e80f3b91f61c7ada2bde434dcaba20d (fixed)

Vendor states this is fixed in 57f332af1745014cd7e40414814ffaa6bc7d3b5b (fixed)

Vendor states this is fixed in 6cb48f8890f9b2051d7c34823057296a536a31c5 (fixed)

Vendor states this is fixed in 90dbad14b109e5fdfb4934ff61e561d11ba3742d (fixed)

Vendor states this is fixed in 915b36d701950503c4ea0f6e314b10868e59fce3 (fixed)

Vendor states this is fixed in 94edbbc5fe00d03cfe1d4e690d7d2cd36317a935 (fixed)

Vendor states this is fixed in bd2ddb3fe9052ad8703593bbec26ecc7ca92869e (fixed)

Vendor states this is fixed in d8fdf33d6fcfb90cbec26299baf2352c84b2d768 (fixed)

Vendor states this is fixed in 2.6.12 (unaffected)

Vendor states this is fixed in 5.10.259 (unaffected)

Vendor states this is fixed in 5.15.210 (unaffected)

Vendor states this is fixed in 6.1.176 (unaffected)