USB: serial: omninet: fix memory corruption with small endpoint
Make sure that the bulk-out buffers are at least as large as the
hardcoded transfer size to avoid user-controlled slab corruption should
a malicious device report a smaller endpoint max packet size than
expected.
Metrics
Affected Vendors & Products
| Source | ID | Title |
|---|---|---|
Ubuntu USN |
USN-8593-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8603-1 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-8618-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8663-1 | Linux kernel (NVIDIA) vulnerabilities |
Ubuntu USN |
USN-8664-1 | Linux kernel (NVIDIA BaseOS) vulnerabilities |
Ubuntu USN |
USN-8728-1 | Linux kernel (GCP) vulnerabilities |
Ubuntu USN |
USN-8728-2 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-8728-3 | Linux kernel (Oracle) vulnerabilities |
Ubuntu USN |
USN-8875-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8877-1 | Linux kernel (GCP) vulnerabilities |
Ubuntu USN |
USN-8878-1 | Linux kernel (GCP) vulnerabilities |
Ubuntu USN |
USN-8879-1 | Linux kernel (Oracle) vulnerabilities |
Ubuntu USN |
USN-8903-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8904-1 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-8905-1 | Linux kernel (GCP) vulnerabilities |
Ubuntu USN |
USN-8906-1 | Linux kernel (IBM) vulnerabilities |
Ubuntu USN |
USN-8875-2 | Linux kernel (NVIDIA) vulnerabilities |
Ubuntu USN |
USN-8903-2 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-8905-2 | Linux kernel (GCP) vulnerabilities |
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Fri, 30 Oct 2026 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* |
|
| Metrics |
cvssV3_1
|
cvssV3_1
|
Tue, 21 Jul 2026 12:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-787 | |
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
Sun, 19 Jul 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: USB: serial: omninet: fix memory corruption with small endpoint Make sure that the bulk-out buffers are at least as large as the hardcoded transfer size to avoid user-controlled slab corruption should a malicious device report a smaller endpoint max packet size than expected. | |
| Title | USB: serial: omninet: fix memory corruption with small endpoint | |
| First Time appeared |
Linux
Linux linux Kernel |
|
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Linux
Linux linux Kernel |
|
| References |
|
|
Projects
Sign in to view the affected projects.
Status: PUBLISHED
Assigner: Linux
Published:
Updated: 2026-07-19T14:55:28.593Z
Reserved: 2026-07-19T07:54:57.021Z
Link: CVE-2026-63928
No data.
Status : Analyzed
Published: 2026-07-19T16:17:11.163
Modified: 2026-10-30T14:29:10.890
Link: CVE-2026-63928
OpenCVE Enrichment
Updated: 2026-10-30T16:15:14Z
Ubuntu USN