Out-of-bounds write in Linux kernel - CVE-2026-63899

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU138752

Out-of-bounds write in Linux kernel - CVE-2026-63899

Published: July 20, 2026


Vulnerability identifier: #VU138752
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-63899
CWE-ID: CWE-787
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to memory corruption in the mxuport USB serial driver when handling a malicious USB device that reports a bulk-out endpoint max packet size smaller than eight bytes. An attacker with physical access can attach a crafted device to cause memory corruption.


Affected software

Linux kernel
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Ubuntu
openEuler
kernel-debugsource
python3-perf-debuginfo
python3-perf
perf-debuginfo
perf
kernel-tools-devel
kernel-tools-debuginfo
kernel-tools
kernel-source
kernel-headers
kernel-devel
kernel-debuginfo
bpftool-debuginfo
bpftool
kernel
kernel-extra-modules
kernel (Red Hat package)
linux (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-oracle-5.15 (Ubuntu package)
linux-gcp-5.15 (Ubuntu package)
linux-gcp (Ubuntu package)
linux-gke (Ubuntu package)
linux-azure (Ubuntu package)
linux-ibm (Ubuntu package)
linux-aws (Ubuntu package)
linux-oracle-7.0 (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
linux-nvidia-bos (Ubuntu package)

How to mitigate CVE-2026-63899

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel-debugsource - addressed in versions 5.10.0-329.0.0.230, 6.6.0-145.3.29.160
python3-perf-debuginfo - addressed in versions 5.10.0-329.0.0.230, 6.6.0-145.3.29.160
python3-perf - addressed in versions 5.10.0-329.0.0.230, 6.6.0-145.3.29.160
perf-debuginfo - addressed in versions 5.10.0-329.0.0.230, 6.6.0-145.3.29.160
perf - addressed in versions 5.10.0-329.0.0.230, 6.6.0-145.3.29.160
kernel-tools-devel - addressed in versions 5.10.0-329.0.0.230, 6.6.0-145.3.29.160
kernel-tools-debuginfo - addressed in versions 5.10.0-329.0.0.230, 6.6.0-145.3.29.160
kernel-tools - addressed in versions 5.10.0-329.0.0.230, 6.6.0-145.3.29.160
kernel-source - addressed in versions 5.10.0-329.0.0.230, 6.6.0-145.3.29.160
kernel-headers - addressed in versions 5.10.0-329.0.0.230, 6.6.0-145.3.29.160
kernel-devel - addressed in versions 5.10.0-329.0.0.230, 6.6.0-145.3.29.160
kernel-debuginfo - addressed in versions 5.10.0-329.0.0.230, 6.6.0-145.3.29.160
bpftool-debuginfo - addressed in versions 5.10.0-329.0.0.230, 6.6.0-145.3.29.160
bpftool - addressed in versions 5.10.0-329.0.0.230, 6.6.0-145.3.29.160
kernel - addressed in versions 5.10.0-329.0.0.230, 6.6.0-145.3.29.160
kernel-extra-modules - update to 6.6.0-145.3.29.160
kernel (Red Hat package) - update to 6.12.0-211.66.1.el10_2
linux (Ubuntu package) - addressed in versions 5.15.0-195.205~20.04.1, 5.15.0-195.205, 5.15.0-198.208~20.04.1, 5.15.0-198.208+fips1, 5.15.0-1080.84, 5.15.0-1100.108, 5.15.0-1109.111, 5.15.0-1109.114, 5.15.0-1111.115~20.04.1, 5.15.0-1111.115, 5.15.0-1112.118~20.04.1, 5.15.0-1112.118, 5.15.0-1113.119, 5.15.0-1114.120, 5.15.0-1116.125~20.04.1, 5.15.0-1117.124~20.04.1, 5.15.0-1117.124, 5.15.0-1117.124+fips1, 5.15.0-1122.131~20.04.1, 5.15.0-1123.132~20.04.1, 5.15.0-1123.132, 5.15.0-1123.132+fips1, 5.15.0.195.160, 5.15.0.195.205~20.04.1, 5.15.0.198.114, 5.15.0.198.171, 5.15.0.198.208~20.04.1, 5.15.0.1080.83~20.04.1, 5.15.0.1100.99, 5.15.0.1109.105, 5.15.0.1109.113, 5.15.0.1111.108, 5.15.0.1111.115~20.04.1, 5.15.0.1112.111, 5.15.0.1112.118~20.04.1, 5.15.0.1113.112, 5.15.0.1114.110, 5.15.0.1116.120, 5.15.0.1117.113, 5.15.0.1117.120, 5.15.0.1117.124~20.04.1, 5.15.0.1122.131~20.04.1, 5.15.0.1123.107, 5.15.0.1123.121, 5.15.0.1123.132~20.04.1
linux-nvidia (Ubuntu package) - addressed in versions 5.15.0-1112.113, 5.15.0.1112.112, 7.0.0-1016.16~24.04.1, 7.0.0-1016.16
linux-oracle-5.15 (Ubuntu package) - addressed in versions 5.15.0-1114.120~20.04.1, 5.15.0.1114.120~20.04.1
linux-gcp-5.15 (Ubuntu package) - addressed in versions 5.15.0-1118.128~20.04.1, 5.15.0.1118.128~20.04.1
linux-gcp (Ubuntu package) - addressed in versions 5.15.0-1118.128, 5.15.0-1118.128+fips1, 5.15.0.1118.107, 5.15.0.1118.115, 6.8.0-1070.78
linux-gke (Ubuntu package) - addressed in versions 6.8.0-146.146.1~22.04.1, 6.8.0-146.146.1, 6.8.0-1051.55, 6.8.0-1063.66, 6.8.0-1064.67~22.04.1, 6.8.0-1064.67, 6.8.0-1064.67.1, 6.8.0-1065.73, 6.8.0-1066.67
linux-azure (Ubuntu package) - addressed in versions 6.8.0-1068.75~22.04.1, 6.8.0-1068.75, 6.8.0-1069.77+fips1, 6.8.0-1070.78~22.04.1, 6.8.0-1070.78, 7.0.0-1009.9, 7.0.0-1010.10
linux-ibm (Ubuntu package) - addressed in versions 7.0.0-1008.8, 7.0.0-1010.10
linux-aws (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1015.15
linux-oracle-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-azure-7.0 (Ubuntu package) - update to 7.0.0-1014.14~24.04.1
linux-nvidia-bos (Ubuntu package) - update to 7.0.0-2016.16

External References

Related Security Bulletins