CVE-2026-63896
usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling The WebUSB GET_URL handler in composite_setup() narrows landing_page_length to fit the host-supplied wLength using landing_page_length = w_length - WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH + landing_page_offset; If wLength is smaller than WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH the unsigned subtraction wraps, and the subsequent memcpy(url_descriptor->URL, cdev->landing_page + landing_page_offset, landing_page_length - landing_page_offset); ends up copying close to UINT_MAX bytes from cdev->landing_page into cdev->req->buf. KASAN reports a slab-out-of-bounds in composite_setup on the kmalloc-2k gadget_info allocation, and FORTIFY_SOURCE traps the memcpy as a 4294967293-byte field-spanning write into url_descriptor->URL (size 252). A USB host can reach this from a single SETUP packet against any gadget that has webusb/use=1 and a landingPage configured. Handle the small-wLength case before the math: when the host requested fewer bytes than the URL descriptor header, only the header is meaningful and no URL bytes need to be copied. Setting landing_page_length to landing_page_offset makes the existing memcpy a no-op and leaves the descriptor returned to the host unchanged for all larger wLength values.
INFO
Published Date :
July 19, 2026, 4:17 p.m.
Last Modified :
July 27, 2026, 5:44 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Apply the Linux kernel patch for USB gadget composite.
- Ensure landing_page_length is handled correctly for small wLength.
- Validate input lengths before performing calculations.
- Update affected Linux kernel systems.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-63896.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-63896 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-63896
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-63896 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-63896 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '93c473948c588978cd55d9a3adad8b3e8057aa21', 'lessThan': '046870ff6b6f7b743c953c061043a9b30700d491', 'versionType': 'git'}, {'status': 'affected', 'version': '93c473948c588978cd55d9a3adad8b3e8057aa21', 'lessThan': 'f5869dfaa89854dcf34121036294d42d6c7acb8f', 'versionType': 'git'}, {'status': 'affected', 'version': '93c473948c588978cd55d9a3adad8b3e8057aa21', 'lessThan': 'f8f5a8f48c7cae3fac85e04b593bd47939f9725f', 'versionType': 'git'}, {'status': 'affected', 'version': '93c473948c588978cd55d9a3adad8b3e8057aa21', 'lessThan': 'a20f0ccf45708af6e063c7234c215d364b00de25', 'versionType': 'git'}, {'status': 'affected', 'version': '93c473948c588978cd55d9a3adad8b3e8057aa21', 'lessThan': '6c5dbc104dadd79fc2923497c20bae759a18758c', 'versionType': 'git'}], 'programFiles': ['drivers/usb/gadget/composite.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.3'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.3', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.93', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.35', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.12', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/usb/gadget/composite.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling The WebUSB GET_URL handler in composite_setup() narrows landing_page_length to fit the host-supplied wLength using landing_page_length = w_length - WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH + landing_page_offset; If wLength is smaller than WEBUSB_URL_DESCRIPTOR_HEADER_LENGTH the unsigned subtraction wraps, and the subsequent memcpy(url_descriptor->URL, cdev->landing_page + landing_page_offset, landing_page_length - landing_page_offset); ends up copying close to UINT_MAX bytes from cdev->landing_page into cdev->req->buf. KASAN reports a slab-out-of-bounds in composite_setup on the kmalloc-2k gadget_info allocation, and FORTIFY_SOURCE traps the memcpy as a 4294967293-byte field-spanning write into url_descriptor->URL (size 252). A USB host can reach this from a single SETUP packet against any gadget that has webusb/use=1 and a landingPage configured. Handle the small-wLength case before the math: when the host requested fewer bytes than the URL descriptor header, only the header is meaningful and no URL bytes need to be copied. Setting landing_page_length to landing_page_offset makes the existing memcpy a no-op and leaves the descriptor returned to the host unchanged for all larger wLength values. Added Reference https://git.kernel.org/stable/c/046870ff6b6f7b743c953c061043a9b30700d491 Added Reference https://git.kernel.org/stable/c/6c5dbc104dadd79fc2923497c20bae759a18758c Added Reference https://git.kernel.org/stable/c/a20f0ccf45708af6e063c7234c215d364b00de25 Added Reference https://git.kernel.org/stable/c/f5869dfaa89854dcf34121036294d42d6c7acb8f Added Reference https://git.kernel.org/stable/c/f8f5a8f48c7cae3fac85e04b593bd47939f9725f