CVE-2026-63902

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the cypress read int callback() function where the system fails to validate interrupt packet headers before reading them. The function parses the interrupt-in buffer based on the selected Cypress packet format, where Format 1 uses a two-byte header and Format 2 uses a one-byte header. Because interrupt transfers can complete short, this lack of validation can lead to out-of-bounds header-byte reads.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.