Search: CVE-2026-63899

A memory corruption vulnerability in the Linux kernel's USB serial mxuport driver has been fixed. The issue arises when a malicious USB device reports a bulk-out endpoint max packet size smaller than eight bytes, which can lead to user-controlled slab corruption. This affects multiple linux-aws kernel versions prior to 7.0.0-28.28~24.04.1 and similar versions. A patch is available and should be applied to mitigate the issue.