CVE-2026-63956

Published: Jul 19, 2026Modified: Oct 30, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypress_m8: fix memory corruption with small endpoint Make sure that the interrupt-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption or NULL-pointer dereference should a malicious device report a smaller size.

Affected (12)

Products: Linux: Linux Kernel

Linux

1 product

Linux Kernel

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	2.6.26 ≤ version < 5.10.259
Linux Linux Kernel	5.11 ≤ version < 5.15.210
Linux Linux Kernel	5.16 ≤ version < 6.1.176
Linux Linux Kernel	6.13 ≤ version < 6.18.35
Linux Linux Kernel	6.19 ≤ version < 7.0.12
Linux Linux Kernel	6.2 ≤ version < 6.6.143
Linux Linux Kernel	6.7 ≤ version < 6.12.93
Linux Linux Kernel	Version 7.1 rc1
Linux Linux Kernel	Version 7.1 rc2
Linux Linux Kernel	Version 7.1 rc3
Linux Linux Kernel	Version 7.1 rc4
Linux Linux Kernel	Version 7.1 rc5