CVE-2026-63903 - Vulnerability Details

- USB: serial: belkin_sa: validate interrupt status length

Description

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: belkin_sa: validate interrupt status length

The Belkin interrupt callback treats interrupt data as a four-byte
status report and reads LSR/MSR fields at offsets 2 and 3. The
interrupt-in buffer length is derived from endpoint wMaxPacketSize, and
short interrupt transfers may complete successfully with a smaller
actual_length.

Check the completed interrupt packet length before parsing status
fields so short interrupt endpoints and short successful packets are
ignored instead of causing out-of-bounds or stale status-byte reads.

KASAN report as below:

BUG: KASAN: slab-out-of-bounds in belkin_sa_read_int_callback()
Read of size 1
Call trace:
belkin_sa_read_int_callback() (drivers/usb/serial/belkin_sa.c:202)
__usb_hcd_giveback_urb() (drivers/usb/core/hcd.c:1630)
dummy_timer() (?:?)

Published: 2026-07-19

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The bug causes the Belkin USB serial interrupt callback to treat every interrupt packet as a four‑byte status report, regardless of the actual length. When a short packet is received, the driver reads status fields at offsets 2 and 3 without validating the packet size. This out‑of‑bounds read can expose contents of adjacent memory or trigger a crash. Based on the description, this could potentially lead to information disclosure or denial of service, but no exploit has been confirmed.

Affected Systems

All Linux kernel installations that include the unpatched drivers/usb/serial/belkin_sa.c are affected. The vulnerability applies to any system—desktop, server, or embedded device—that uses a Belkin USB serial adapter with an affected kernel.

Risk and Exploitability

The CVSS score of 5.5 indicates medium severity, and the EPSS score of less than 1% reflects a low probability of exploitation. The vulnerability is not listed in CISA KEV. Based on the description, an attacker would need to influence the attached USB device to send a short interrupt packet; however, no publicly available exploit or documented attack path exists.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< f1617539ab90e67da788959bfd314076f093a11a
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< f361359a952da15e70e693c2d7dca5c5843eae3e
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 37e54d1b986df35c936d81e5b59a7aa3ec6938f0
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< ffb739a49186ea784bbd9cb91b647f062395b419
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 6a4602221cba7a738442328d66a2f0b1c9bf6e17
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 22823a319fb2afdf02cacafbed8b613b757efbc8
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< db1e7eb6203d534dad64cac2c793b69e561e657b
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 4ce058df2ee02cc2a0f0fd5cd64ce6f1482a0b65

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.93`	unaffected	≤ 6.12.*
`6.18.35`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f1617539ab90e67da788959bfd314076f093a11a)`	affected	code_commit	—
`[f1617539ab90e67da788959bfd314076f093a11a,f361359a952da15e70e693c2d7dca5c5843eae3e)`	affected	code_commit	—
`[f361359a952da15e70e693c2d7dca5c5843eae3e,37e54d1b986df35c936d81e5b59a7aa3ec6938f0)`	affected	code_commit	—
`[37e54d1b986df35c936d81e5b59a7aa3ec6938f0,ffb739a49186ea784bbd9cb91b647f062395b419)`	affected	code_commit	—
`[ffb739a49186ea784bbd9cb91b647f062395b419,6a4602221cba7a738442328d66a2f0b1c9bf6e17)`	affected	code_commit	—
`[6a4602221cba7a738442328d66a2f0b1c9bf6e17,22823a319fb2afdf02cacafbed8b613b757efbc8)`	affected	code_commit	—
`[22823a319fb2afdf02cacafbed8b613b757efbc8,db1e7eb6203d534dad64cac2c793b69e561e657b)`	affected	code_commit	—
`[db1e7eb6203d534dad64cac2c793b69e561e657b,4ce058df2ee02cc2a0f0fd5cd64ce6f1482a0b65)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[5.10.259,5.11.0]`	unaffected	semver	—
`[5.15.210,5.16.0]`	unaffected	semver	—
`[6.1.176,6.2.0]`	unaffected	semver	—
`[6.6.143,6.7.0]`	unaffected	semver	—
`[6.12.93,6.13.0]`	unaffected	semver	—
`[7.0.12,7.1.0]`	unaffected	semver	—
`[7.1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that incorporates the patch for drivers/usb/serial/belkin_sa.c.
If an immediate update is not possible, blacklist the belkin_sa module to prevent it from loading, thereby disabling the vulnerable driver.
Replace the Belkin USB serial adapter with a different model that does not use the problematic driver.

Generated by OpenCVE AI on August 4, 2026 at 06:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00211.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/22823a319fb2afdf02cacafbed8b613b757efbc8
https://git.kernel.org/stable/c/37e54d1b986df35c936d81e5b59a7aa3ec6938f0
https://git.kernel.org/stable/c/4ce058df2ee02cc2a0f0fd5cd64ce6f1482a0b65
https://git.kernel.org/stable/c/6a4602221cba7a738442328d66a2f0b1c9bf6e17
https://git.kernel.org/stable/c/db1e7eb6203d534dad64cac2c793b69e561e657b
https://git.kernel.org/stable/c/f1617539ab90e67da788959bfd314076f093a11a
https://git.kernel.org/stable/c/f361359a952da15e70e693c2d7dca5c5843eae3e
https://git.kernel.org/stable/c/ffb739a49186ea784bbd9cb91b647f062395b419
https://lore.kernel.org/linux-cve-announce/2026071944-CVE-2026-63903-eeba@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63903
https://www.cve.org/CVERecord?id=CVE-2026-63903

History

Mon, 27 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119

Wed, 22 Jul 2026 19:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119

Wed, 22 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026071944-CVE-2026-63903-eeba@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63903 https://www.cve.org/CVERecord?id=CVE-2026-63903
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 19 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: USB: serial: belkin_sa: validate interrupt status length The Belkin interrupt callback treats interrupt data as a four-byte status report and reads LSR/MSR fields at offsets 2 and 3. The interrupt-in buffer length is derived from endpoint wMaxPacketSize, and short interrupt transfers may complete successfully with a smaller actual_length. Check the completed interrupt packet length before parsing status fields so short interrupt endpoints and short successful packets are ignored instead of causing out-of-bounds or stale status-byte reads. KASAN report as below: BUG: KASAN: slab-out-of-bounds in belkin_sa_read_int_callback() Read of size 1 Call trace: belkin_sa_read_int_callback() (drivers/usb/serial/belkin_sa.c:202) __usb_hcd_giveback_urb() (drivers/usb/core/hcd.c:1630) dummy_timer() (?:?)
Title		USB: serial: belkin_sa: validate interrupt status length
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/22823a319fb2afdf02cacafbed8b613b757efbc8 https://git.kernel.org/stable/c/37e54d1b986df35c936d81e5b59a7aa3ec6938f0 https://git.kernel.org/stable/c/4ce058df2ee02cc2a0f0fd5cd64ce6f1482a0b65 https://git.kernel.org/stable/c/6a4602221cba7a738442328d66a2f0b1c9bf6e17 https://git.kernel.org/stable/c/db1e7eb6203d534dad64cac2c793b69e561e657b https://git.kernel.org/stable/c/f1617539ab90e67da788959bfd314076f093a11a https://git.kernel.org/stable/c/f361359a952da15e70e693c2d7dca5c5843eae3e https://git.kernel.org/stable/c/ffb739a49186ea784bbd9cb91b647f062395b419

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T14:55:10.905Z

Updated: 2026-07-19T14:55:10.905Z

Reserved: 2026-07-19T07:54:57.019Z

Link: CVE-2026-63903

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63903 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-04T07:00:05Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object