CVE-2026-63956

A flaw was found in the Linux kernel's cypressm8 USB serial driver. A malicious Universal Serial Bus USB device could report a packet size smaller than eight bytes for the interrupt-out endpoint. This can lead to memory corruption, specifically user-controlled slab corruption or a NULL-pointer...

CVE-2026-63902

A flaw was found in the Linux kernel's cypressm8 USB serial driver. This vulnerability allows a local attacker to cause a denial of service DoS due to an out-of-bounds read. The cypressreadintcallback function does not properly validate the length of interrupt packets, leading to attempts to read...

CVE-2026-63956

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypressm8: fix memory corruption with small endpoint Make sure that the interrupt-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption or NULL-pointer dereference should a...

CVE-2026-63902

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypressm8: validate interrupt packet headers cypressreadintcallback parses the interrupt-in buffer according to the selected Cypress packet format. Format 1 has a two-byte status/count header and format 2 has a...

CVE-2026-63956 USB: serial: cypress_m8: fix memory corruption with small endpoint

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypressm8: fix memory corruption with small endpoint Make sure that the interrupt-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption or NULL-pointer dereference should a...

CVE-2026-63956 USB: serial: cypress_m8: fix memory corruption with small endpoint

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypressm8: fix memory corruption with small endpoint Make sure that the interrupt-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption or NULL-pointer dereference should a...

EUVD-2026-45729

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypressm8: fix memory corruption with small endpoint Make sure that the interrupt-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption or NULL-pointer dereference should a...

CVE-2026-63956

The CVE-2026-63956 entry describes a Linux kernel vulnerability in USB serial for Cypress M8 devices. The issue occurs when the interrupt-out endpoint max packet size is smaller than eight bytes, enabling potential user-controlled slab corruption or NULL-pointer dereference if a malicious device ...

CVE-2026-63902 USB: serial: cypress_m8: validate interrupt packet headers

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypressm8: validate interrupt packet headers cypressreadintcallback parses the interrupt-in buffer according to the selected Cypress packet format. Format 1 has a two-byte status/count header and format 2 has a...

EUVD-2026-45675

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypressm8: validate interrupt packet headers cypressreadintcallback parses the interrupt-in buffer according to the selected Cypress packet format. Format 1 has a two-byte status/count header and format 2 has a...

CVE-2026-63902 USB: serial: cypress_m8: validate interrupt packet headers

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypressm8: validate interrupt packet headers cypressreadintcallback parses the interrupt-in buffer according to the selected Cypress packet format. Format 1 has a two-byte status/count header and format 2 has a...

PT-2026-61273

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypress m8: fix memory corruption with small endpoint Make sure that the interrupt-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption or NULL-pointer dereference should a...

PT-2026-61219

In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypress m8: validate interrupt packet headers cypress read int callback parses the interrupt-in buffer according to the selected Cypress packet format. Format 1 has a two-byte status/count header and format 2 has a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000866)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000866 advisory. drivers/usb/serial/cypressm8.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service NULL pointer dereference and syste...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003120)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003120 advisory. drivers/usb/serial/cypressm8.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service NULL pointer dereference and syste...

SUSE CVE-2016-3137

drivers/usb/serial/cypressm8.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service NULL pointer dereference and system crash via a USB device without both an interrupt-in and an interrupt-out endpoint descriptor, related to the cypressgenericportpro...

Ubuntu: Security Advisory (USN-2996-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-3000-1 linux-lts-utopic vulnerabilities

Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux kernel incorrectly enables scatter/gather I/O. A remote attacker could use this to obtain potentially sensitive information from kernel memory. CVE-2016-2117 Jann Horn discovered that eCryptfs improperly attempted to use...

USN-3000-1: Linux kernel (Utopic HWE) vulnerabilities

Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux kernel incorrectly enables scatter/gather I/O. A remote attacker could use this to obtain potentially sensitive information from kernel memory. CVE-2016-2117 Jann Horn discovered that eCryptfs improperly attempted to use...

USN-2997-1: Linux kernel (OMAP4) vulnerabilities

Jann Horn discovered that eCryptfs improperly attempted to use the mmap handler of a lower filesystem that did not implement one, causing a recursive page fault to occur. A local unprivileged attacker could use to cause a denial of service system crash or possibly execute arbitrary code with...