Not yet scoredPublished Jul 19, 2026

CVE-2026-63901USB: serial: digi_acceleport: fix memory corruption with small endpoints

Updated under an hour ago (Oct 28, 2026, 7:40 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digi_acceleport: fix memory corruption with small endpoints Add the missing bulk-out buffer size sanity checks to avoid out-of-bounds memory accesses or slab corruption should a malicious device report smaller buffers than expected.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Awaiting Analysis
Record last updated: Jul 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before fd34198c2e5d164b57a7dcd4692626fece319225; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 25b93d0f229a115ab120106f37b9454170d4cfd4; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 6ab1e9ae099577a1019312088309ecbad2da9a91; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 8a65db5edd7b63365e9c5b7d9f4b8f314696dc49; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 41b645e791099f0038225da5e2ca3ca31f00d435; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 062dcc0b324afd03b1406f157190804f105718bb; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 9469419b12a100e7e2ccdda64ab45b8368456c8a; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before cb3560e8eab1dfa1cac1ed52631adf8ec6ff2cd5	CNA record

References

References

https://git.kernel.org/stable/c/fd34198c2e5d164b57a7dcd4692626fece319225
https://git.kernel.org/stable/c/25b93d0f229a115ab120106f37b9454170d4cfd4
https://git.kernel.org/stable/c/6ab1e9ae099577a1019312088309ecbad2da9a91
https://git.kernel.org/stable/c/8a65db5edd7b63365e9c5b7d9f4b8f314696dc49
https://git.kernel.org/stable/c/41b645e791099f0038225da5e2ca3ca31f00d435
https://git.kernel.org/stable/c/062dcc0b324afd03b1406f157190804f105718bb
https://git.kernel.org/stable/c/9469419b12a100e7e2ccdda64ab45b8368456c8a
https://git.kernel.org/stable/c/cb3560e8eab1dfa1cac1ed52631adf8ec6ff2cd5

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.