CVE-2026-63900

A flaw was found in the Linux kernel's USB Keyspan serial driver. This vulnerability stems from a missing sanity check on the size of incoming data transfers for usa49wg indat transfers. This oversight could allow an attacker to cause the system to parse stale or uninitialized memory, potentially leading to information disclosure.

This vulnerability is rated as Moderate for Red Hat Enterprise Linux because exploitation requires physical access to attach a crafted USB device or privileged access to an emulated host USB bus. While the driver is shipped with the kernel, it is not loaded by default unless a matching Keyspan serial adapter is physically plugged into the machine. Consequently, standard enterprise server and cloud deployments that do not attach specialized USB serial peripherals or expose virtual USB ports to untrusted guests remain unaffected under normal operating conditions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.