Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-63898

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mct_u232: fix memory corruption with small endpoint The driver overrides the maximum transfer size for a specific device which only accepts 16 byte packets for its 32 byte bulk-out endpoint. Make sure to never increase the maximum transfer size to prevent slab corruption should a malicious device report a smaller endpoint max packet size than expected.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:7e51e548c0ca123c265e8589fd4223bf72c0c88284d94ea8b5051c88442a491f
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/serial/mct_u232.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:e7f0bebcd8e4d693372b7625a970e6846eb30f8cd91bc14ddcd8afb1c454a098 · sha256:6305c778e5290a72… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/serial/mct_u232.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"94edbbc5fe00d03cfe1d4e690d7d2cd36317a935","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"bd2ddb3fe9052ad8703593bbec26ecc7ca92869e","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"39e295a91e80f3b91f61c7ada2bde434dcaba20d","status":"affected","version":"1da177e4c3f41524…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:e7f0bebcd8e4d693372b7625a970e6846eb30f8cd91bc14ddcd8afb1c454a098 · sha256:6305c778e5290a72… · /containers/cna/affected/0

Affected products and versions

2 source assertions
{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/serial/mct_u232.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:e7f0bebcd8e4d693372b7625a970e6846eb30f8cd91bc14ddcd8afb1c454a098 · sha256:6305c778e5290a72… · /containers/cna/affected/1
{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/serial/mct_u232.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"94edbbc5fe00d03cfe1d4e690d7d2cd36317a935","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"bd2ddb3fe9052ad8703593bbec26ecc7ca92869e","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"39e295a91e80f3b91f61c7ada2bde434dcaba20d","status":"affected","version":"1da177e4c3f41524…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:e7f0bebcd8e4d693372b7625a970e6846eb30f8cd91bc14ddcd8afb1c454a098 · sha256:6305c778e5290a72… · /containers/cna/affected/0

Source references

8 source assertions
{"url":"https://git.kernel.org/stable/c/39e295a91e80f3b91f61c7ada2bde434dcaba20d"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e7f0bebcd8e4d693372b7625a970e6846eb30f8cd91bc14ddcd8afb1c454a098 · sha256:6305c778e5290a72… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/57f332af1745014cd7e40414814ffaa6bc7d3b5b"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e7f0bebcd8e4d693372b7625a970e6846eb30f8cd91bc14ddcd8afb1c454a098 · sha256:6305c778e5290a72… · /containers/cna/references/6
{"url":"https://git.kernel.org/stable/c/6cb48f8890f9b2051d7c34823057296a536a31c5"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e7f0bebcd8e4d693372b7625a970e6846eb30f8cd91bc14ddcd8afb1c454a098 · sha256:6305c778e5290a72… · /containers/cna/references/4
{"url":"https://git.kernel.org/stable/c/90dbad14b109e5fdfb4934ff61e561d11ba3742d"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e7f0bebcd8e4d693372b7625a970e6846eb30f8cd91bc14ddcd8afb1c454a098 · sha256:6305c778e5290a72… · /containers/cna/references/3
{"url":"https://git.kernel.org/stable/c/915b36d701950503c4ea0f6e314b10868e59fce3"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e7f0bebcd8e4d693372b7625a970e6846eb30f8cd91bc14ddcd8afb1c454a098 · sha256:6305c778e5290a72… · /containers/cna/references/7
{"url":"https://git.kernel.org/stable/c/94edbbc5fe00d03cfe1d4e690d7d2cd36317a935"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e7f0bebcd8e4d693372b7625a970e6846eb30f8cd91bc14ddcd8afb1c454a098 · sha256:6305c778e5290a72… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/bd2ddb3fe9052ad8703593bbec26ecc7ca92869e"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e7f0bebcd8e4d693372b7625a970e6846eb30f8cd91bc14ddcd8afb1c454a098 · sha256:6305c778e5290a72… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/d8fdf33d6fcfb90cbec26299baf2352c84b2d768"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e7f0bebcd8e4d693372b7625a970e6846eb30f8cd91bc14ddcd8afb1c454a098 · sha256:6305c778e5290a72… · /containers/cna/references/5

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer