CVE-2026-63896

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling

The WebUSB GETURL handler in compositesetup() narrows landingpagelength to fit the host-supplied wLength using

landing_page_length = w_length
    - WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH + landing_page_offset;

If wLength is smaller than WEBUSBURLDESCRIPTORHEADERLENGTH the unsigned subtraction wraps, and the subsequent

memcpy(url_descriptor->URL,
       cdev->landing_page + landing_page_offset,
       landing_page_length - landing_page_offset);

ends up copying close to UINTMAX bytes from cdev->landingpage into cdev->req->buf. KASAN reports a slab-out-of-bounds in compositesetup on the kmalloc-2k gadgetinfo allocation, and FORTIFYSOURCE traps the memcpy as a 4294967293-byte field-spanning write into urldescriptor->URL (size 252).

A USB host can reach this from a single SETUP packet against any gadget that has webusb/use=1 and a landingPage configured.

Handle the small-wLength case before the math: when the host requested fewer bytes than the URL descriptor header, only the header is meaningful and no URL bytes need to be copied. Setting landingpagelength to landingpageoffset makes the existing memcpy a no-op and leaves the descriptor returned to the host unchanged for all larger wLength values.