CVE-2026-63904

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63904", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.019Z", "datePublished": "2026-07-19T14:55:11.547Z", "dateUpdated": "2026-07-19T14:55:11.547Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-19T14:55:11.547Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: usbtmc: check URB actual_length for interrupt-IN notifications\n\nUSBTMC devices can use an optional interrupt endpoint for notification\nmessages. These typically contain two-byte headers indicating the\npayload format, but the driver does not check if these headers are\npresent before accessing the data buffers. In cases where the URB\nactual_length is not enough to fit these headers, the driver will either\ncause an out-of-bounds read, or consume stale leftover data from a\nprevious notification.\n\nFix by checking if actual_data contains enough bytes for the headers,\notherwise resubmit URB to the interrupt endpoint."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/class/usbtmc.c"], "versions": [{"version": "dbf3e7f654c0f06a932b8fcafac78de9d0b81d68", "lessThan": "e794bd67b3faf98af46f958897f6b91412c7d2a9", "status": "affected", "versionType": "git"}, {"version": "dbf3e7f654c0f06a932b8fcafac78de9d0b81d68", "lessThan": "e3eec3005de44e7f37d8d7724be636446516ab42", "status": "affected", "versionType": "git"}, {"version": "dbf3e7f654c0f06a932b8fcafac78de9d0b81d68", "lessThan": "ae87f505917e703ae3b487d9663d78826ff43608", "status": "affected", "versionType": "git"}, {"version": "dbf3e7f654c0f06a932b8fcafac78de9d0b81d68", "lessThan": "5de7df75ef3a2756b25fe3d582a4a2970444fe5a", "status": "affected", "versionType": "git"}, {"version": "dbf3e7f654c0f06a932b8fcafac78de9d0b81d68", "lessThan": "69020fa089f1bf0e1a10a15265f31b143a846409", "status": "affected", "versionType": "git"}, {"version": "dbf3e7f654c0f06a932b8fcafac78de9d0b81d68", "lessThan": "75f6d3da2cc646983f41807ef98851569c12bca9", "status": "affected", "versionType": "git"}, {"version": "dbf3e7f654c0f06a932b8fcafac78de9d0b81d68", "lessThan": "f141b01eaa58ac7e323931d670318aa247bff087", "status": "affected", "versionType": "git"}, {"version": "dbf3e7f654c0f06a932b8fcafac78de9d0b81d68", "lessThan": "52f2ad3f7e5eb3b5908e1d685d4342519dc9cfcd", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/class/usbtmc.c"], "versions": [{"version": "4.6", "status": "affected"}, {"version": "0", "lessThan": "4.6", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.259", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.93", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "5.10.259"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "5.15.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.1.176"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.6.143"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.12.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.18.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e794bd67b3faf98af46f958897f6b91412c7d2a9"}, {"url": "https://git.kernel.org/stable/c/e3eec3005de44e7f37d8d7724be636446516ab42"}, {"url": "https://git.kernel.org/stable/c/ae87f505917e703ae3b487d9663d78826ff43608"}, {"url": "https://git.kernel.org/stable/c/5de7df75ef3a2756b25fe3d582a4a2970444fe5a"}, {"url": "https://git.kernel.org/stable/c/69020fa089f1bf0e1a10a15265f31b143a846409"}, {"url": "https://git.kernel.org/stable/c/75f6d3da2cc646983f41807ef98851569c12bca9"}, {"url": "https://git.kernel.org/stable/c/f141b01eaa58ac7e323931d670318aa247bff087"}, {"url": "https://git.kernel.org/stable/c/52f2ad3f7e5eb3b5908e1d685d4342519dc9cfcd"}], "title": "usb: usbtmc: check URB actual_length for interrupt-IN notifications", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/class/usbtmc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e794bd67b3faf98af46f958897f6b91412c7d2a9", "status": "affected", "version": "dbf3e7f654c0f06a932b8fcafac78de9d0b81d68", "versionType": "git"}, {"lessThan": "e3eec3005de44e7f37d8d7724be636446516ab42", "status": "affected", "version": "dbf3e7f654c0f06a932b8fcafac78de9d0b81d68", "versionType": "git"}, {"lessThan": "ae87f505917e703ae3b487d9663d78826ff43608", "status": "affected", "version": "dbf3e7f654c0f06a932b8fcafac78de9d0b81d68", "versionType": "git"}, {"lessThan": "5de7df75ef3a2756b25fe3d582a4a2970444fe5a", "status": "affected", "version": "dbf3e7f654c0f06a932b8fcafac78de9d0b81d68", "versionType": "git"}, {"lessThan": "69020fa089f1bf0e1a10a15265f31b143a846409", "status": "affected", "version": "dbf3e7f654c0f06a932b8fcafac78de9d0b81d68", "versionType": "git"}, {"lessThan": "75f6d3da2cc646983f41807ef98851569c12bca9", "status": "affected", "version": "dbf3e7f654c0f06a932b8fcafac78de9d0b81d68", "versionType": "git"}, {"lessThan": "f141b01eaa58ac7e323931d670318aa247bff087", "status": "affected", "version": "dbf3e7f654c0f06a932b8fcafac78de9d0b81d68", "versionType": "git"}, {"lessThan": "52f2ad3f7e5eb3b5908e1d685d4342519dc9cfcd", "status": "affected", "version": "dbf3e7f654c0f06a932b8fcafac78de9d0b81d68", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/class/usbtmc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.6"}, {"lessThan": "4.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.259", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.210", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.176", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.143", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.93", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.35", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5600752B-5EBB-43C5-ACFC-8AD628C79467", "versionEndExcluding": "5.10.259", "versionStartIncluding": "4.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801", "versionEndExcluding": "5.15.210", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757", "versionEndExcluding": "6.1.176", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C", "versionEndExcluding": "6.6.143", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1E73413E-0629-41AA-A4D3-5A3D10A0BD63", "versionEndExcluding": "6.12.93", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0FCCB23A-7629-4386-93B6-B119237C4382", "versionEndExcluding": "6.18.35", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9161A938-0FA8-44BC-95FE-C5A271601AB3", "versionEndExcluding": "7.0.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: usbtmc: check URB actual_length for interrupt-IN notifications\n\nUSBTMC devices can use an optional interrupt endpoint for notification\nmessages. These typically contain two-byte headers indicating the\npayload format, but the driver does not check if these headers are\npresent before accessing the data buffers. In cases where the URB\nactual_length is not enough to fit these headers, the driver will either\ncause an out-of-bounds read, or consume stale leftover data from a\nprevious notification.\n\nFix by checking if actual_data contains enough bytes for the headers,\notherwise resubmit URB to the interrupt endpoint."}], "id": "CVE-2026-63904", "lastModified": "2026-10-30T14:37:41.347", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-07-19T16:17:08.130", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/52f2ad3f7e5eb3b5908e1d685d4342519dc9cfcd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5de7df75ef3a2756b25fe3d582a4a2970444fe5a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/69020fa089f1bf0e1a10a15265f31b143a846409"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/75f6d3da2cc646983f41807ef98851569c12bca9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ae87f505917e703ae3b487d9663d78826ff43608"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e3eec3005de44e7f37d8d7724be636446516ab42"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e794bd67b3faf98af46f958897f6b91412c7d2a9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f141b01eaa58ac7e323931d670318aa247bff087"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: usb: usbtmc: check URB actual_length for interrupt-IN notifications", "id": "2502458", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502458"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nusb: usbtmc: check URB actual_length for interrupt-IN notifications\nUSBTMC devices can use an optional interrupt endpoint for notification\nmessages. These typically contain two-byte headers indicating the\npayload format, but the driver does not check if these headers are\npresent before accessing the data buffers. In cases where the URB\nactual_length is not enough to fit these headers, the driver will either\ncause an out-of-bounds read, or consume stale leftover data from a\nprevious notification.\nFix by checking if actual_data contains enough bytes for the headers,\notherwise resubmit URB to the interrupt endpoint.", "A flaw was found in the Linux kernel's USB Test and Measurement Class (USBTMC) driver. This vulnerability occurs because the driver does not properly verify the size of incoming notification messages, specifically failing to ensure that required two-byte headers are present. An attacker could exploit this by sending malformed USBTMC messages, potentially leading to an out-of-bounds read. This could result in a system crash (Denial of Service) or the disclosure of sensitive information."], "name": "CVE-2026-63904", "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63904\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63904\nhttps://lore.kernel.org/linux-cve-announce/2026071944-CVE-2026-63904-e989@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[dbf3e7f654c0f06a932b8fcafac78de9d0b81d68,e794bd67b3faf98af46f958897f6b91412c7d2a9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[dbf3e7f654c0f06a932b8fcafac78de9d0b81d68,e3eec3005de44e7f37d8d7724be636446516ab42)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[dbf3e7f654c0f06a932b8fcafac78de9d0b81d68,ae87f505917e703ae3b487d9663d78826ff43608)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[dbf3e7f654c0f06a932b8fcafac78de9d0b81d68,5de7df75ef3a2756b25fe3d582a4a2970444fe5a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[dbf3e7f654c0f06a932b8fcafac78de9d0b81d68,69020fa089f1bf0e1a10a15265f31b143a846409)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[dbf3e7f654c0f06a932b8fcafac78de9d0b81d68,75f6d3da2cc646983f41807ef98851569c12bca9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[dbf3e7f654c0f06a932b8fcafac78de9d0b81d68,f141b01eaa58ac7e323931d670318aa247bff087)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[dbf3e7f654c0f06a932b8fcafac78de9d0b81d68,52f2ad3f7e5eb3b5908e1d685d4342519dc9cfcd)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.259,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.210,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.176,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.143,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.93,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.35,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.12,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T17:45:02.485715+00:00", "updated": "2026-10-30T16:15:14.986929+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}