CVE-2026-63903

A flaw was found in the Linux kernel's belkin_sa USB serial driver. The driver's interrupt handling routine fails to validate the length of incoming status reports. This oversight allows a local attacker, by connecting a specially crafted USB device, to trigger an out-of-bounds read. The primary consequence is a system crash, leading to a denial of service.

This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux because exploitation requires local access with the capability to attach a physical or emulated USB device. The issue is contained within the Belkin USB serial driver, which is only activated when an appropriate hardware adapter is connected. Standard enterprise and server deployments typically restrict physical access to peripheral ports, and virtualized guest instances do not attach arbitrary USB devices by default. As a result, exploitation is constrained to a local denial of service via a kernel crash without risk to system integrity or confidentiality.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.