CVE-2026-63903

USB: serial: belkin_sa: validate interrupt status length

State: Published
Severity: Not scored
Published: Jul 19, 2026
Updated: Jul 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: belkin_sa: validate interrupt status length

The Belkin interrupt callback treats interrupt data as a four-byte status report and reads LSR/MSR fields at offsets 2 and 3. The interrupt-in buffer length is derived from endpoint wMaxPacketSize, and short interrupt transfers may complete successfully with a smaller actual_length.

Check the completed interrupt packet length before parsing status fields so short interrupt endpoints and short successful packets are ignored instead of causing out-of-bounds or stale status-byte reads.

KASAN report as below:

BUG: KASAN: slab-out-of-bounds in belkin_sa_read_int_callback() Read of size 1 Call trace: belkin_sa_read_int_callback() (drivers/usb/serial/belkin_sa.c:202) __usb_hcd_giveback_urb() (drivers/usb/core/hcd.c:1630) dummy_timer() (?:?)

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f1617539ab90e67da788959bfd314076f093a11aAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f361359a952da15e70e693c2d7dca5c5843eae3eAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 37e54d1b986df35c936d81e5b59a7aa3ec6938f0Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ffb739a49186ea784bbd9cb91b647f062395b419Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6a4602221cba7a738442328d66a2f0b1c9bf6e17Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 22823a319fb2afdf02cacafbed8b613b757efbc8Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before db1e7eb6203d534dad64cac2c793b69e561e657bAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 4ce058df2ee02cc2a0f0fd5cd64ce6f1482a0b65Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.93 through 6.12.Not affected 6.18.35 through 6.18.Not affected 7.0.12 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f1617539ab90e67da788959bfd314076f093a11aAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f361359a952da15e70e693c2d7dca5c5843eae3eAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 37e54d1b986df35c936d81e5b59a7aa3ec6938f0Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ffb739a49186ea784bbd9cb91b647f062395b419Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6a4602221cba7a738442328d66a2f0b1c9bf6e17Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 22823a319fb2afdf02cacafbed8b613b757efbc8Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before db1e7eb6203d534dad64cac2c793b69e561e657bAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 4ce058df2ee02cc2a0f0fd5cd64ce6f1482a0b65Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.93 through 6.12.*Not affected
6.18.35 through 6.18.*Not affected
7.0.12 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.