Medium [CVE-2026-63904] check URB actual_length for interrupt-IN notifications

In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: check URB actual_length for interrupt-IN notifications USBTMC devices can use an optional interrupt endpoint for notification messages.

These typically contain two-byte headers indicating the payload format, but the driver does not check if these headers are present before accessing the data buffers. In cases where the URB actual_length is not enough to fit these headers, the driver will either cause an out-of-bounds read, or consume stale leftover data from a previous notification.

Fix by checking if actual_data contains enough bytes for the headers, otherwise resubmit URB to the interrupt endpoint. A flaw was found in the Linux kernel's USB Test and Measurement Class (USBTMC) driver.

This vulnerability occurs because the driver does not properly verify the size of incoming notification messages, specifically failing to ensure that required two-byte headers are present. An attacker could exploit this by sending malformed USBTMC messages, potentially leading to an out-of-bounds read.

This could result in a system crash (Denial of Service) or the disclosure of sensitive information. This vulnerability is evaluated as Moderate because successful exploitation requires local access or the connection of a specialized, malformed USB device, limiting the attack scope primarily to a local system crash.