CVE-2026-63902

A flaw was found in the Linux kernel's cypress_m8 USB serial driver. This vulnerability allows a local attacker to cause a denial of service (DoS) due to an out-of-bounds read. The cypress_read_int_callback() function does not properly validate the length of interrupt packets, leading to attempts to read beyond allocated memory when processing malformed short reports. This can result in system instability.

This vulnerability is rated as having a Moderate impact because an attacker with local access or the capability to attach emulated USB peripherals can cause a kernel crash, resulting in a denial of service. The flaw does not warrant an Important rating as it cannot be triggered remotely and does not lead to code execution or privilege escalation. Additionally, the cypress_m8 kernel driver is not loaded by default on Red Hat Enterprise Linux systems unless a compatible Cypress USB serial device is physically or virtually connected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.