CVE-2026-63897

A flaw was found in the Linux kernel's mct_u232 USB serial driver. This vulnerability stems from an inadequate check on the size of data transfers from a USB device. This oversight could allow the system to process outdated or uninitialized kernel memory, potentially leading to information disclosure where sensitive data from the kernel is exposed to a local user.

This vulnerability is rated as Moderate impact because successful exploitation requires the presence of specialized physical hardware or an emulated USB device, limiting the blast radius in typical enterprise server deployments. The affected mct_u232 driver only loads when a compatible adapter is connected or forwarded to a virtual machine. Without physical access or guest USB passthrough capabilities, local attackers cannot trigger the kernel memory leak or driver malfunction.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.