CVE-2026-63904

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: usbtmc: check URB actual_length for interrupt-IN notifications<br /> <br /> USBTMC devices can use an optional interrupt endpoint for notification<br /> messages. These typically contain two-byte headers indicating the<br /> payload format, but the driver does not check if these headers are<br /> present before accessing the data buffers. In cases where the URB<br /> actual_length is not enough to fit these headers, the driver will either<br /> cause an out-of-bounds read, or consume stale leftover data from a<br /> previous notification.<br /> <br /> Fix by checking if actual_data contains enough bytes for the headers,<br /> otherwise resubmit URB to the interrupt endpoint.