Not yet scoredPublished Jul 19, 2026

CVE-2026-63928USB: serial: omninet: fix memory corruption with small endpoint

Updated under an hour ago (Oct 28, 2026, 3:40 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: USB: serial: omninet: fix memory corruption with small endpoint Make sure that the bulk-out buffers are at least as large as the hardcoded transfer size to avoid user-controlled slab corruption should a malicious device report a smaller endpoint max packet size than expected.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Awaiting Analysis
Record last updated: Jul 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 180996f0ca774001944e4afa452d569ba2f6455c; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before b496e25ead5976bce2891dacaed09beb53a54f9f; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 4e7d32189d6219beb7db37cd0ea36b6bac7dfedb; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 9a3860454bdfb765f936965e975c594352602ffc; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 builds before 0bda1893e4cc4ad2b7dcdbaca246f2af688c6c2a; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 builds before 0fee0ccac29e088d4bfab7e2d075725dcecd803d; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f34cf2928387fba01a78381f3258c7e1428897d9; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 60df93d30f9bdd27db17c4d80ed80ef718d7226b	CNA record

References

References

https://git.kernel.org/stable/c/180996f0ca774001944e4afa452d569ba2f6455c
https://git.kernel.org/stable/c/b496e25ead5976bce2891dacaed09beb53a54f9f
https://git.kernel.org/stable/c/4e7d32189d6219beb7db37cd0ea36b6bac7dfedb
https://git.kernel.org/stable/c/9a3860454bdfb765f936965e975c594352602ffc
https://git.kernel.org/stable/c/0bda1893e4cc4ad2b7dcdbaca246f2af688c6c2a
https://git.kernel.org/stable/c/0fee0ccac29e088d4bfab7e2d075725dcecd803d
https://git.kernel.org/stable/c/f34cf2928387fba01a78381f3258c7e1428897d9
https://git.kernel.org/stable/c/60df93d30f9bdd27db17c4d80ed80ef718d7226b

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.