In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
The WebUSB GET_URL handler in composite_setup() narrows
landing_page_length to fit the host-supplied wLength using
landing_page_length = w_length
- WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH + landing_page_offset;
If wLength is smaller than WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH the
unsigned subtraction wraps, and the subsequent
memcpy(url_descriptor->URL,
cdev->landing_page + landing_page_offset,
landing_page_length - landing_page_offset);
ends up copying close to UINT_MAX bytes from cdev->landing_page into
cdev->req->buf. KASAN reports a slab-out-of-bounds in composite_setup
on the kmalloc-2k gadget_info allocation, and FORTIFY_SOURCE traps the
memcpy as a 4294967293-byte field-spanning write into
url_descriptor->URL (size 252).
A USB host can reach this from a single SETUP packet against any
gadget that has webusb/use=1 and a landingPage configured.
Handle the small-wLength case before the math: when the host requested
fewer bytes than the URL descriptor header, only the header is
meaningful and no URL bytes need to be copied. Setting
landing_page_length to landing_page_offset makes the existing memcpy a
no-op and leaves the descriptor returned to the host unchanged for all
larger wLength values.
References
Configurations
Configuration 1 (hide)
|
History
12 Nov 2026, 15:02
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* |
|
| First Time |
Linux linux Kernel
Linux |
|
| CWE | CWE-190 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| References | () https://git.kernel.org/stable/c/046870ff6b6f7b743c953c061043a9b30700d491 - Patch | |
| References | () https://git.kernel.org/stable/c/6c5dbc104dadd79fc2923497c20bae759a18758c - Patch | |
| References | () https://git.kernel.org/stable/c/a20f0ccf45708af6e063c7234c215d364b00de25 - Patch | |
| References | () https://git.kernel.org/stable/c/f5869dfaa89854dcf34121036294d42d6c7acb8f - Patch | |
| References | () https://git.kernel.org/stable/c/f8f5a8f48c7cae3fac85e04b593bd47939f9725f - Patch |
Information
Published : 2026-07-19 16:17
Updated : 2026-11-12 15:02
NVD link : CVE-2026-63896
Mitre link : CVE-2026-63896
CVE.ORG link : CVE-2026-63896
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-190
Integer Overflow or Wraparound