CVE-2026-63896 (GCVE-0-2026-63896)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-07-19 14:55
VLAI
Title
usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling The WebUSB GET_URL handler in composite_setup() narrows landing_page_length to fit the host-supplied wLength using landing_page_length = w_length - WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH + landing_page_offset; If wLength is smaller than WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH the unsigned subtraction wraps, and the subsequent memcpy(url_descriptor->URL, cdev->landing_page + landing_page_offset, landing_page_length - landing_page_offset); ends up copying close to UINT_MAX bytes from cdev->landing_page into cdev->req->buf. KASAN reports a slab-out-of-bounds in composite_setup on the kmalloc-2k gadget_info allocation, and FORTIFY_SOURCE traps the memcpy as a 4294967293-byte field-spanning write into url_descriptor->URL (size 252). A USB host can reach this from a single SETUP packet against any gadget that has webusb/use=1 and a landingPage configured. Handle the small-wLength case before the math: when the host requested fewer bytes than the URL descriptor header, only the header is meaningful and no URL bytes need to be copied. Setting landing_page_length to landing_page_offset makes the existing memcpy a no-op and leaves the descriptor returned to the host unchanged for all larger wLength values.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 93c473948c588978cd55d9a3adad8b3e8057aa21 , < 046870ff6b6f7b743c953c061043a9b30700d491 (git)
Affected: 93c473948c588978cd55d9a3adad8b3e8057aa21 , < f5869dfaa89854dcf34121036294d42d6c7acb8f (git)
Affected: 93c473948c588978cd55d9a3adad8b3e8057aa21 , < f8f5a8f48c7cae3fac85e04b593bd47939f9725f (git)
Affected: 93c473948c588978cd55d9a3adad8b3e8057aa21 , < a20f0ccf45708af6e063c7234c215d364b00de25 (git)
Affected: 93c473948c588978cd55d9a3adad8b3e8057aa21 , < 6c5dbc104dadd79fc2923497c20bae759a18758c (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/composite.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "046870ff6b6f7b743c953c061043a9b30700d491",
              "status": "affected",
              "version": "93c473948c588978cd55d9a3adad8b3e8057aa21",
              "versionType": "git"
            },
            {
              "lessThan": "f5869dfaa89854dcf34121036294d42d6c7acb8f",
              "status": "affected",
              "version": "93c473948c588978cd55d9a3adad8b3e8057aa21",
              "versionType": "git"
            },
            {
              "lessThan": "f8f5a8f48c7cae3fac85e04b593bd47939f9725f",
              "status": "affected",
              "version": "93c473948c588978cd55d9a3adad8b3e8057aa21",
              "versionType": "git"
            },
            {
              "lessThan": "a20f0ccf45708af6e063c7234c215d364b00de25",
              "status": "affected",
              "version": "93c473948c588978cd55d9a3adad8b3e8057aa21",
              "versionType": "git"
            },
            {
              "lessThan": "6c5dbc104dadd79fc2923497c20bae759a18758c",
              "status": "affected",
              "version": "93c473948c588978cd55d9a3adad8b3e8057aa21",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/composite.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: composite: fix integer underflow in WebUSB GET_URL handling\n\nThe WebUSB GET_URL handler in composite_setup() narrows\nlanding_page_length to fit the host-supplied wLength using\n\n\tlanding_page_length = w_length\n\t\t- WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH + landing_page_offset;\n\nIf wLength is smaller than WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH the\nunsigned subtraction wraps, and the subsequent\n\n\tmemcpy(url_descriptor-\u003eURL,\n\t       cdev-\u003elanding_page + landing_page_offset,\n\t       landing_page_length - landing_page_offset);\n\nends up copying close to UINT_MAX bytes from cdev-\u003elanding_page into\ncdev-\u003ereq-\u003ebuf.  KASAN reports a slab-out-of-bounds in composite_setup\non the kmalloc-2k gadget_info allocation, and FORTIFY_SOURCE traps the\nmemcpy as a 4294967293-byte field-spanning write into\nurl_descriptor-\u003eURL (size 252).\n\nA USB host can reach this from a single SETUP packet against any\ngadget that has webusb/use=1 and a landingPage configured.\n\nHandle the small-wLength case before the math: when the host requested\nfewer bytes than the URL descriptor header, only the header is\nmeaningful and no URL bytes need to be copied.  Setting\nlanding_page_length to landing_page_offset makes the existing memcpy a\nno-op and leaves the descriptor returned to the host unchanged for all\nlarger wLength values."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T14:55:06.152Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/046870ff6b6f7b743c953c061043a9b30700d491"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5869dfaa89854dcf34121036294d42d6c7acb8f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8f5a8f48c7cae3fac85e04b593bd47939f9725f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a20f0ccf45708af6e063c7234c215d364b00de25"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c5dbc104dadd79fc2923497c20bae759a18758c"
        }
      ],
      "title": "usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63896",
    "datePublished": "2026-07-19T14:55:06.152Z",
    "dateReserved": "2026-07-19T07:54:57.019Z",
    "dateUpdated": "2026-07-19T14:55:06.152Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63896",
      "date": "2026-09-21",
      "epss": "0.00214",
      "percentile": "0.12083"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/usb/gadget/composite.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "046870ff6b6f7b743c953c061043a9b30700d491",
                    "status": "affected",
                    "version": "93c473948c588978cd55d9a3adad8b3e8057aa21",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f5869dfaa89854dcf34121036294d42d6c7acb8f",
                    "status": "affected",
                    "version": "93c473948c588978cd55d9a3adad8b3e8057aa21",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f8f5a8f48c7cae3fac85e04b593bd47939f9725f",
                    "status": "affected",
                    "version": "93c473948c588978cd55d9a3adad8b3e8057aa21",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a20f0ccf45708af6e063c7234c215d364b00de25",
                    "status": "affected",
                    "version": "93c473948c588978cd55d9a3adad8b3e8057aa21",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6c5dbc104dadd79fc2923497c20bae759a18758c",
                    "status": "affected",
                    "version": "93c473948c588978cd55d9a3adad8b3e8057aa21",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/usb/gadget/composite.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.3"
                  },
                  {
                    "lessThan": "6.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: composite: fix integer underflow in WebUSB GET_URL handling\n\nThe WebUSB GET_URL handler in composite_setup() narrows\nlanding_page_length to fit the host-supplied wLength using\n\n\tlanding_page_length = w_length\n\t\t- WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH + landing_page_offset;\n\nIf wLength is smaller than WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH the\nunsigned subtraction wraps, and the subsequent\n\n\tmemcpy(url_descriptor-\u003eURL,\n\t       cdev-\u003elanding_page + landing_page_offset,\n\t       landing_page_length - landing_page_offset);\n\nends up copying close to UINT_MAX bytes from cdev-\u003elanding_page into\ncdev-\u003ereq-\u003ebuf.  KASAN reports a slab-out-of-bounds in composite_setup\non the kmalloc-2k gadget_info allocation, and FORTIFY_SOURCE traps the\nmemcpy as a 4294967293-byte field-spanning write into\nurl_descriptor-\u003eURL (size 252).\n\nA USB host can reach this from a single SETUP packet against any\ngadget that has webusb/use=1 and a landingPage configured.\n\nHandle the small-wLength case before the math: when the host requested\nfewer bytes than the URL descriptor header, only the header is\nmeaningful and no URL bytes need to be copied.  Setting\nlanding_page_length to landing_page_offset makes the existing memcpy a\nno-op and leaves the descriptor returned to the host unchanged for all\nlarger wLength values."
          }
        ],
        "id": "CVE-2026-63896",
        "lastModified": "2026-07-27T17:44:23.777",
        "metrics": {},
        "published": "2026-07-19T16:17:07.130",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/046870ff6b6f7b743c953c061043a9b30700d491"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6c5dbc104dadd79fc2923497c20bae759a18758c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a20f0ccf45708af6e063c7234c215d364b00de25"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f5869dfaa89854dcf34121036294d42d6c7acb8f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f8f5a8f48c7cae3fac85e04b593bd47939f9725f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-07T12:45:08+00:00",
      "cve": "CVE-2026-63896",
      "id": "CVE-2026-63896",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63896.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:46:46Z",
      "cve": "CVE-2026-63896",
      "id": "CVE-2026-63896",
      "initial_release_date": "2026-07-21T13:04:03Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "424",
      "product_status:known_not_affected": "326",
      "product_status:recommended": "250",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63896",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63896.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.