CVE-2026-63903

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> USB: serial: belkin_sa: validate interrupt status length<br /> <br /> The Belkin interrupt callback treats interrupt data as a four-byte<br /> status report and reads LSR/MSR fields at offsets 2 and 3. The<br /> interrupt-in buffer length is derived from endpoint wMaxPacketSize, and<br /> short interrupt transfers may complete successfully with a smaller<br /> actual_length.<br /> <br /> Check the completed interrupt packet length before parsing status<br /> fields so short interrupt endpoints and short successful packets are<br /> ignored instead of causing out-of-bounds or stale status-byte reads.<br /> <br /> KASAN report as below:<br /> <br /> BUG: KASAN: slab-out-of-bounds in belkin_sa_read_int_callback()<br /> Read of size 1<br /> Call trace:<br /> belkin_sa_read_int_callback() (drivers/usb/serial/belkin_sa.c:202)<br /> __usb_hcd_giveback_urb() (drivers/usb/core/hcd.c:1630)<br /> dummy_timer() (?:?)