CVE-2026-63896

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63896
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63896.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63896
Downstream
Related
Published
2026-07-19T14:55:06Z
Modified
2026-08-31T18:26:03Z
Summary
usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
Details

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling

The WebUSB GET_URL handler in composite_setup() narrows landing_page_length to fit the host-supplied wLength using

landing_page_length = w_length
	- WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH + landing_page_offset;

If wLength is smaller than WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH the unsigned subtraction wraps, and the subsequent

memcpy(url_descriptor->URL,
       cdev->landing_page + landing_page_offset,
       landing_page_length - landing_page_offset);

ends up copying close to UINT_MAX bytes from cdev->landing_page into cdev->req->buf. KASAN reports a slab-out-of-bounds in composite_setup on the kmalloc-2k gadget_info allocation, and FORTIFY_SOURCE traps the memcpy as a 4294967293-byte field-spanning write into url_descriptor->URL (size 252).

A USB host can reach this from a single SETUP packet against any gadget that has webusb/use=1 and a landingPage configured.

Handle the small-wLength case before the math: when the host requested fewer bytes than the URL descriptor header, only the header is meaningful and no URL bytes need to be copied. Setting landing_page_length to landing_page_offset makes the existing memcpy a no-op and leaves the descriptor returned to the host unchanged for all larger wLength values.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63896.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
93c473948c588978cd55d9a3adad8b3e8057aa21
Fixed
046870ff6b6f7b743c953c061043a9b30700d491
Fixed
f5869dfaa89854dcf34121036294d42d6c7acb8f
Fixed
f8f5a8f48c7cae3fac85e04b593bd47939f9725f
Fixed
a20f0ccf45708af6e063c7234c215d364b00de25
Fixed
6c5dbc104dadd79fc2923497c20bae759a18758c

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63896.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.3.0
Fixed
6.6.143
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.93
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.35
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.0.12

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63896.json"