CVE-2026-63898
highIn the Linux kernel, the following vulnerability has been resolved: USB: serial: mct_u232: fix memory corruption with small endpoint The driver overrides the…
Vendor / product: Linux — linux kernel
In the Linux kernel, the following vulnerability has been resolved: USB: serial: mct_u232: fix memory corruption with small endpoint The driver overrides the maximum transfer size for a specific device which only accepts 16 byte packets for its 32 byte bulk-out endpoint. Make sure to never increase the maximum transfer size to prevent slab corruption should a malicious device report a smaller endpoint max packet size than expected.
CVSS
7.8
7.8 (CVSS v3.1)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-07-19 16:17
Modified: 2026-10-30 14:38
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-10-30 14:40 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
linux / linux_kernel ≥2.6.12.1 <5.10.259, ≥5.11 <5.15.210, ≥5.16 <6.1.176, ≥6.2 <6.6.143, ≥6.7 <6.12.94, ≥6.13 <6.18.35
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://git.kernel.org/stable/c/39e295a91e80f3b91f61c7ada2bde434dcaba20d
Patch / mitigation: https://git.kernel.org/stable/c/57f332af1745014cd7e40414814ffaa6bc7d3b5b
Patch / mitigation: https://git.kernel.org/stable/c/6cb48f8890f9b2051d7c34823057296a536a31c5
Patch / mitigation: https://git.kernel.org/stable/c/90dbad14b109e5fdfb4934ff61e561d11ba3742d
Patch / mitigation: https://git.kernel.org/stable/c/915b36d701950503c4ea0f6e314b10868e59fce3
Patch / mitigation: https://git.kernel.org/stable/c/94edbbc5fe00d03cfe1d4e690d7d2cd36317a935
Patch / mitigation: https://git.kernel.org/stable/c/bd2ddb3fe9052ad8703593bbec26ecc7ca92869e
Patch / mitigation: https://git.kernel.org/stable/c/d8fdf33d6fcfb90cbec26299baf2352c84b2d768
References
- https://git.kernel.org/stable/c/39e295a91e80f3b91f61c7ada2bde434dcaba20d 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- https://git.kernel.org/stable/c/57f332af1745014cd7e40414814ffaa6bc7d3b5b 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- https://git.kernel.org/stable/c/6cb48f8890f9b2051d7c34823057296a536a31c5 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- https://git.kernel.org/stable/c/90dbad14b109e5fdfb4934ff61e561d11ba3742d 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- https://git.kernel.org/stable/c/915b36d701950503c4ea0f6e314b10868e59fce3 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- https://git.kernel.org/stable/c/94edbbc5fe00d03cfe1d4e690d7d2cd36317a935 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- https://git.kernel.org/stable/c/bd2ddb3fe9052ad8703593bbec26ecc7ca92869e 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- https://git.kernel.org/stable/c/d8fdf33d6fcfb90cbec26299baf2352c84b2d768 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Data sources
NVD CVE API 2.0 — fetched 2026-10-30 14:40 UTC · record ↗