Not yet scoredPublished Jul 19, 2026

CVE-2026-63957USB: serial: safe_serial: fix memory corruption with small endpoint

Updated under an hour ago (Oct 28, 2026, 7:10 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: USB: serial: safe_serial: fix memory corruption with small endpoint Make sure that the bulk-out buffer size is at least eight bytes to avoid user-controlled slab corruption in "safe" mode should a malicious device report a smaller size.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Awaiting Analysis
Record last updated: Jul 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before e3a1d6eee25dc96b1d2db0ecd9d8741e92056476; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before c7336c0fba5c959249f3d793d33076b992ec3ee4; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 161ea0e5236f5f051d2d85d6c54dd08ee9dc7ba4; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 9b3145b3001fb24de1da72d1deb0bea70e5a078b; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before a550ed2117ca4709d38f713933ff924a83942e41; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f793b67d41e5fab719c5a90baa77cbd2fe259517; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 857b3cc73f91871ae4433f8b97c4670b78f8dc96; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 438061ed1ad85e6743e2dce826671772d81089ec	CNA record

References

References

https://git.kernel.org/stable/c/e3a1d6eee25dc96b1d2db0ecd9d8741e92056476
https://git.kernel.org/stable/c/c7336c0fba5c959249f3d793d33076b992ec3ee4
https://git.kernel.org/stable/c/161ea0e5236f5f051d2d85d6c54dd08ee9dc7ba4
https://git.kernel.org/stable/c/9b3145b3001fb24de1da72d1deb0bea70e5a078b
https://git.kernel.org/stable/c/a550ed2117ca4709d38f713933ff924a83942e41
https://git.kernel.org/stable/c/f793b67d41e5fab719c5a90baa77cbd2fe259517
https://git.kernel.org/stable/c/857b3cc73f91871ae4433f8b97c4670b78f8dc96
https://git.kernel.org/stable/c/438061ed1ad85e6743e2dce826671772d81089ec

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.