CVE-2026-63900: USB: serial: keyspan: fix missing indat transfer sanity check

Published Jul 19, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: keyspan: fix missing indat transfer sanity check

Add the missing sanity check on the size of usa49wg indat transfers to avoid parsing stale or uninitialised slab data.

Affected Software

1 affected component

The Linux Kernel Mailing List Linux kernel

Jul 19, 2026

CVE Published

via MITRE·02:55 PM

Data Sourced

via MITRE·02:55 PM

Description

Data Sourced

via NVD·04:17 PM

Description

CVE-2026-63900 has a risk score of 27, indicating a significant security concern.

To fix CVE-2026-63900, ensure you update the Linux kernel to a version that includes the patch addressing the missing indat transfer sanity check.

CVE-2026-63900 impacts systems running the Linux kernel that utilize the keyspan USB serial driver.

Without remediation, CVE-2026-63900 may allow exploitation through parsing stale or uninitialized slab data, posing a risk to system integrity.

CVE-2026-63900 was published on July 19, 2026.