CVE-2026-63932

A flaw was found in the Linux kernel's mhz19b driver, which handles Winsen MHZ19B CO2 sensors. The mhz19b_receive_buf() function does not properly validate the size of incoming serial replies before copying them into a fixed-size buffer. A remote attacker could exploit this by sending an oversized serial reply, leading to a buffer overflow. This could result in a denial of service or potentially more severe impacts by overwriting critical data within the kernel.