CVE-2026-63903

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: belkin_sa: validate interrupt status length

The Belkin interrupt callback treats interrupt data as a four-byte

status report and reads LSR/MSR fields at offsets 2 and 3. The

interrupt-in buffer length is derived from endpoint wMaxPacketSize, and

short interrupt transfers may complete successfully with a smaller

actual_length.

Check the completed interrupt packet length before parsing status

fields so short interrupt endpoints and short successful packets are

ignored instead of causing out-of-bounds or stale status-byte reads.

KASAN report as below:

BUG: KASAN: slab-out-of-bounds in belkin_sa_read_int_callback()

Read of size 1

Call trace:

belkin_sa_read_int_callback() (drivers/usb/serial/belkin_sa.c:202)

__usb_hcd_giveback_urb() (drivers/usb/core/hcd.c:1630)

dummy_timer() (?:?)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References