CVE-2026-63904 usb: usbtmc: check URB actual_length for interrupt-IN notifications
A malicious USB device can trigger an out-of-bounds read in the Linux kernel USBTMC driver, potentially leaking memory or causing a crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63904?
CVE-2026-63904 is a memory corruption vulnerability in Linux, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: usbtmc: check URB actual_length for interrupt-IN notifications
USBTMC devices can use an optional interrupt endpoint for notification messages. These typically contain two-byte headers indicating the payload format, but the driver does not check if these headers are present before accessing the data buffers. In cases where the URB actual_length is not enough to fit these headers, the driver will either cause an out-of-bounds read, or consume stale leftover data from a previous notification.
Fix by checking if actual_data contains enough bytes for the headers, otherwise resubmit URB to the interrupt endpoint.
Which versions are affected by CVE-2026-63904?
How do I fix CVE-2026-63904?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-63904 being exploited?
There is no known exploitation of CVE-2026-63904 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-63904, DEBIAN-CVE-2026-63904, GHSA-7gx5-8c2m-vqr5, ROOT-OS-UBUNTU-2204-CVE-2026-63904, UBUNTU-CVE-2026-63904.