CVE-2026-63904

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: usbtmc: check URB actual_length for interrupt-IN notifications

USBTMC devices can use an optional interrupt endpoint for notification

messages. These typically contain two-byte headers indicating the

payload format, but the driver does not check if these headers are

present before accessing the data buffers. In cases where the URB

actual_length is not enough to fit these headers, the driver will either

cause an out-of-bounds read, or consume stale leftover data from a

previous notification.

Fix by checking if actual_data contains enough bytes for the headers,

otherwise resubmit URB to the interrupt endpoint.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References