# CVE-2026-63902: USB: serial: cypress_m8: validate interrupt packet headers

> A local attacker with physical access can trigger an out-of-bounds read in the Cypress M8 USB serial driver, potentially causing a system crash or code execution.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** A user has to click or open something
- **Fix available:** Yes
- **Published:** 19 Jul 2026
- **Updated:** 19 Jul 2026
- **Also known as:** BELL-CVE-2026-63902, DEBIAN-CVE-2026-63902, GHSA-28gg-7x4r-8gcw, ROOT-OS-UBUNTU-2204-CVE-2026-63902, UBUNTU-CVE-2026-63902

## What is CVE-2026-63902?

CVE-2026-63902 is a memory corruption vulnerability in Linux, published on 19 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: cypress_m8: validate interrupt packet headers

cypress_read_int_callback() parses the interrupt-in buffer according to
the selected Cypress packet format. Format 1 has a two-byte status/count
header and format 2 has a one-byte combined status/count header. The
usb-serial core sizes the interrupt-in buffer from the endpoint
descriptor's wMaxPacketSize, and successful interrupt transfers can
complete short when URB_SHORT_NOT_OK is not set.

Check that the completed packet contains the selected header before
reading it. Malformed short reports are ignored and the interrupt URB is
resubmitted through the existing retry path, preventing out-of-bounds
header-byte reads.

KASAN report as below:
KASAN slab-out-of-bounds in cypress_read_int_callback+0x240/0x7f0
Read of size 1
Call trace:
  cypress_read_int_callback() (drivers/usb/serial/cypress_m8.c:1009)
  __usb_hcd_giveback_urb()
  dummy_timer()

[ johan: use constants in header length sanity checks ]

## Which versions are affected by CVE-2026-63902?


## How do I fix CVE-2026-63902?

Apply the vendor's patch.

## Is CVE-2026-63902 being exploited?

There is no known exploitation of CVE-2026-63902 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-63902 and fix it if it is affected.

What it is: CVE-2026-63902 is a memory corruption vulnerability in Linux, published on 19 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Exploitation: There is no known exploitation of CVE-2026-63902 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-63902/ (Markdown: https://insights.sbomify.com/CVE-2026-63902/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-63902
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63902
- OSV: https://osv.dev/vulnerability/CVE-2026-63902

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-63902/
Summaries are generated and may contain mistakes; the official description above is the record.