CVE-2026-63896

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An integer underflow exists in the WebUSB GET URL handler within the composite setup() function. When the host-supplied wLength is smaller than the WEBUSB URL DESCRIPTOR HEADER LENGTH, an unsigned subtraction wraps, leading to a slab-out-of-bounds write. This allows a USB host to trigger a massive memory copy from cdev->landing page into cdev->req->buf using a single SETUP packet, provided the gadget has webusb/use=1 and a configured landing page.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.