Threats Tagged 'cve-2026-63896'

A vulnerability in the Linux kernel's USB gadget composite driver was fixed, addressing an integer underflow in the WebUSB GET_URL handling. The flaw occurs when the host-supplied wLength is smaller than a descriptor header length, causing an unsigned subtraction wrap and leading to an out-of-bounds memory copy. This can result in memory corruption. The issue affects multiple Linux kernel versions prior to 7.0.0-28.28 and various specific versions listed. A patch is available and should be applied to mitigate the risk.

A vulnerability in the Linux kernel's USB gadget composite driver related to WebUSB GET_URL handling causes an integer underflow. This underflow can lead to an out-of-bounds memory copy when the host supplies a small wLength value, potentially causing memory corruption. The issue arises because the code subtracts a constant from wLength without checking if wLength is smaller than that constant, resulting in an unsigned wraparound. The vulnerability is triggered by a USB host sending a crafted SETUP packet to a gadget with webusb/use=1 and a landingPage configured. The fix involves handling the small wLength case before the arithmetic to prevent the underflow and avoid copying excessive bytes.