CVE-2026-63957

USB: serial: safe_serial: fix memory corruption with small endpoint

HIGH

7.8

CVSS Score

Published: July 19, 2026 at 02:55 PM UTC

Updated: October 30, 2026 at 02:32 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: USB: serial: safe_serial: fix memory corruption with small endpoint Make sure that the bulk-out buffer size is at least eight bytes to avoid user-controlled slab corruption in "safe" mode should a malicious device report a smaller size.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

2.6.12.1 ≤ v < 5.10.2595.11 ≤ v < 5.15.2105.16 ≤ v < 6.1.1766.13 ≤ v < 6.18.356.19 ≤ v < 7.0.126.2 ≤ v < 6.6.1436.7 ≤ v < 6.12.931da177e4c3f41524e886b7f1b8a0c1fc7321cac2 2.6.12 7.1

Vendor states this is fixed in 161ea0e5236f5f051d2d85d6c54dd08ee9dc7ba4 (fixed)

Vendor states this is fixed in 438061ed1ad85e6743e2dce826671772d81089ec (fixed)

Vendor states this is fixed in 857b3cc73f91871ae4433f8b97c4670b78f8dc96 (fixed)

Vendor states this is fixed in 9b3145b3001fb24de1da72d1deb0bea70e5a078b (fixed)

Vendor states this is fixed in a550ed2117ca4709d38f713933ff924a83942e41 (fixed)

Vendor states this is fixed in c7336c0fba5c959249f3d793d33076b992ec3ee4 (fixed)

Vendor states this is fixed in e3a1d6eee25dc96b1d2db0ecd9d8741e92056476 (fixed)

Vendor states this is fixed in f793b67d41e5fab719c5a90baa77cbd2fe259517 (fixed)

Vendor states this is fixed in 2.6.12 (unaffected)

Vendor states this is fixed in 5.10.259 (unaffected)

Vendor states this is fixed in 5.15.210 (unaffected)

Vendor states this is fixed in 6.1.176 (unaffected)