CVE intelligence

CVE-2026-63904

Vulnerability intelligence

Published Jul 19, 2026Sources checked Oct 8, 2026

N/ACVSS not listedScore unavailable

What this means

Review the available evidence

CVE-2026-63904. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

CISA KEVNot listedBased on the latest collected catalog

EPSS0.2%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-63904?

In the Linux kernel, the following vulnerability has been resolved:

usb: usbtmc: check URB actual_length for interrupt-IN notifications

USBTMC devices can use an optional interrupt endpoint for notification messages. These typically contain two-byte headers indicating the payload format, but the driver does not check if these headers are present before accessing the data buffers.

In cases where the URB actual_length is not enough to fit these headers, the driver will either cause an out-of-bounds read, or consume stale leftover data from a previous notification.

Fix by checking if actual_data contains enough bytes for the headers, otherwise resubmit URB to the interrupt endpoint.

Source: NVD