CVE-2026-63956

What it actually does

This is a Linux kernel memory-corruption flaw in the USB serial cypress_m8 driver. A malicious USB device can advertise an interrupt-out endpoint with a maximum packet size smaller than the driver expects. On vulnerable kernels, the driver may still bind to the device and later perform operations assuming at least an 8-byte endpoint buffer, which can lead to user-controlled slab memory corruption or a NULL-pointer dereference in kernel space. The most likely technical outcomes are kernel crash and denial of service; under favorable conditions, memory corruption in kernel context may have higher-impact exploitation potential, although no public exploit maturity is currently reported.

Why it matters to the business

Systems that allow untrusted USB devices to be connected may be crashed or potentially compromised at the operating-system kernel level by a malicious peripheral. The practical business risk is highest for workstations, kiosks, industrial systems, lab machines, shared terminals, and servers where physical access or USB device insertion is possible. Current exploitation signals are low: EPSS is 0.00211, it is not listed in CISA KEV, it is not associated with ransomware use, and no exploit maturity is reported. Even so, because the flaw is in kernel code and can be triggered by hardware, organizations with exposed USB ports or weak device-control policies should prioritize patching and USB restrictions.

How an attack unfolds

An attacker prepares a USB device that emulates hardware handled by the Linux cypress_m8 USB serial driver but supplies a malformed USB descriptor where the interrupt-out endpoint reports a packet size smaller than eight bytes. The attacker then gains an opportunity to attach the device to a vulnerable Linux system, either through direct physical access, supply-chain substitution, social engineering, or use in a shared or kiosk-like environment. When the device is inserted, the kernel enumerates it and the cypress_m8 driver may bind to it. Because the vulnerable driver did not sufficiently validate the endpoint size, later driver operations can write or operate beyond the allocated endpoint buffer or dereference an invalid pointer. This can trigger a kernel oops, panic, system crash, or potentially controlled memory corruption in kernel space. There is no current indication of broad in-the-wild exploitation, named threat actor use, or ransomware use.

How to fix it

Apply the Linux kernel update from the relevant distribution or vendor that includes the fix for the cypress_m8 USB serial endpoint-size validation issue. No exact fixed package versions were provided in the input, so use vendor advisories for the deployed distribution and kernel branch. Where immediate patching is not possible, reduce exposure by disabling or blacklisting the cypress_m8 driver if it is not required, for example by preventing the cypress_m8 module from loading. Enforce USB device-control policies using tools such as USBGuard or equivalent endpoint controls, restrict physical access to USB ports, disable unused USB ports in firmware or operating-system policy where feasible, and allow only trusted USB serial adapters. For high-assurance systems, consider setting default USB authorization to deny and explicitly authorizing approved devices only.

How to confirm the fix worked

Confirm the running kernel contains the vendor fix by checking the installed kernel package version against the distribution security advisory or changelog for the cypress_m8 endpoint-size validation patch. Verify whether the vulnerable driver is present or loaded using checks such as listing loaded modules for cypress_m8 and reviewing kernel configuration for USB serial cypress_m8 support. Confirm mitigations by ensuring the cypress_m8 module cannot be loaded if it is not needed, and by testing that unapproved USB devices are blocked by USB device-control policy. Review system logs after remediation to ensure malicious or malformed USB devices are rejected cleanly and do not produce kernel oops, panic, NULL-pointer dereference, KASAN, or slab-corruption messages associated with cypress_m8.

Typical attack path

1. Attacker creates or modifies a USB device to emulate a cypress_m8-supported USB serial adapter.
2. The malicious device advertises an interrupt-out endpoint with a maximum packet size smaller than eight bytes.
3. Attacker gets the device connected to a vulnerable Linux host through physical access, a planted peripheral, social engineering, or an uncontrolled USB port.
4. The Linux kernel enumerates the device and loads or binds the cypress_m8 USB serial driver.
5. The vulnerable driver accepts the malformed endpoint descriptor instead of rejecting the device.
6. Driver activity against the undersized endpoint causes slab memory corruption or a NULL-pointer dereference in kernel space.
7. The host experiences a kernel crash, denial of service, or potentially more severe kernel-level compromise if the memory corruption is exploitable.

How to detect it

Look for evidence of suspicious USB serial device insertion followed by kernel instability. Primary log sources are kernel logs, system journal entries, audit logs, endpoint detection telemetry, USB device-control logs, and crash dump records. Search for cypress_m8 driver binding or ttyCY device creation immediately before kernel oops, panic, KASAN, slab allocator, general protection fault, or NULL-pointer dereference messages. On systems with crash dumps enabled, inspect vmcore, kdump, or apport-style crash artifacts for stack traces involving cypress_m8 or USB serial paths. USBGuard or endpoint-control logs may show newly attached, unauthorized, or unusual USB serial devices. Because the trigger is a malformed USB descriptor and no public exploit pattern is reported, absence of a specific log string does not rule out exploitation; correlate physical access events, device insertion times, and kernel crashes.

• cypress_m8
• ttyCY
• usbserial: USB Serial support registered for DeLorme Earthmate USB
• usbserial: USB Serial support registered for HID->COM RS232 Adapter
• cypress_m8 tty
• BUG: unable to handle kernel NULL pointer dereference
• Unable to handle kernel NULL pointer dereference
• KASAN: slab-out-of-bounds
• KASAN: use-after-free
• kernel BUG at
• general protection fault
• Oops:
• Kernel panic
• slab corruption
• corrupted memory
• /sys/bus/usb-serial/drivers/cypress_m8
• /sys/module/cypress_m8
• /lib/modules/*/kernel/drivers/usb/serial/cypress_m8.ko

What your security team should do

• Patch Linux systems with vendor kernel updates that include the cypress_m8 USB serial driver fix, prioritizing endpoints and systems with accessible USB ports.
• Inventory systems where the cypress_m8 driver is present, loaded, or required for business operations.
• If the driver is not needed, blacklist or disable cypress_m8 as a compensating control.
• Enforce USB device-control policy so only approved peripherals can be used, especially on kiosks, shared workstations, industrial systems, and physically exposed servers.
• Review recent kernel logs for cypress_m8 device enumeration followed by kernel oops, panic, KASAN, slab-corruption, or NULL-pointer dereference messages.
• Educate support and facilities teams not to connect unknown USB serial adapters or found USB devices to production systems.
• Because current EPSS and exploitation maturity are low and the issue is not in KEV, prioritize according to physical exposure and USB-control maturity rather than internet exposure.