CVE-2026-63903

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the belkin sa read int callback() function within the USB serial driver for Belkin devices. The interrupt callback processes interrupt data as a four-byte status report, reading LSR/MSR fields at offsets 2 and 3. Because the interrupt-in buffer length is based on the wMaxPacketSize of the endpoint, short interrupt transfers may complete with an actual length smaller than expected. This can lead to slab-out-of-bounds reads or the processing of stale status bytes when parsing the status fields.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.