Not yet scoredPublished Jul 19, 2026

CVE-2026-63903USB: serial: belkin_sa: validate interrupt status length

Updated under an hour ago (Oct 28, 2026, 11:50 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: USB: serial: belkin_sa: validate interrupt status length The Belkin interrupt callback treats interrupt data as a four-byte status report and reads LSR/MSR fields at offsets 2 and 3. The interrupt-in buffer length is derived from endpoint wMaxPacketSize, and short interrupt transfers may complete successfully with a smaller actual_length. Check the completed interrupt packet length before parsing status fields so short interrupt endpoints and short successful packets are ignored instead of causing out-of-bounds or stale status-byte reads. KASAN report as below: BUG: KASAN: slab-out-of-bounds in belkin_sa_read_int_callback() Read of size 1 Call trace: belkin_sa_read_int_callback() (drivers/usb/serial/belkin_sa.c:202) __usb_hcd_giveback_urb() (drivers/usb/core/hcd.c:1630) dummy_timer() (?:?)

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Awaiting Analysis
Record last updated: Jul 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f1617539ab90e67da788959bfd314076f093a11a; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f361359a952da15e70e693c2d7dca5c5843eae3e; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 37e54d1b986df35c936d81e5b59a7aa3ec6938f0; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before ffb739a49186ea784bbd9cb91b647f062395b419; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 6a4602221cba7a738442328d66a2f0b1c9bf6e17; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 22823a319fb2afdf02cacafbed8b613b757efbc8; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before db1e7eb6203d534dad64cac2c793b69e561e657b; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 4ce058df2ee02cc2a0f0fd5cd64ce6f1482a0b65	CNA record

References

References

https://git.kernel.org/stable/c/f1617539ab90e67da788959bfd314076f093a11a
https://git.kernel.org/stable/c/f361359a952da15e70e693c2d7dca5c5843eae3e
https://git.kernel.org/stable/c/37e54d1b986df35c936d81e5b59a7aa3ec6938f0
https://git.kernel.org/stable/c/ffb739a49186ea784bbd9cb91b647f062395b419
https://git.kernel.org/stable/c/6a4602221cba7a738442328d66a2f0b1c9bf6e17
https://git.kernel.org/stable/c/22823a319fb2afdf02cacafbed8b613b757efbc8
https://git.kernel.org/stable/c/db1e7eb6203d534dad64cac2c793b69e561e657b
https://git.kernel.org/stable/c/4ce058df2ee02cc2a0f0fd5cd64ce6f1482a0b65

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.