In the Linux kernel, the following vulnerability has been resolved: USB: serial: mct_u232: fix memory corruption with small endpoint The driver overrides the maximum transfer size for a specific device which only accepts 16 byte packets for its 32 byte bulk-out endpoint. Make sure to never increase the maximum transfer size to prevent slab corruption should a malicious device report a smaller endpoint max packet size than expected.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-073353 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    USB: serial: mct_u232: fix memory corruption with small endpoint

    The driver overrides the maximum transfer size for a specific device     which only accepts 16 byte packets for its 32 byte bulk-out endpoint.

    Make sure to never increase the maximum transfer size to prevent slab     corruption should a malicious device report a smaller endpoint max     packet size than expected.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - USB: serial: mct_u232: fix memory corruption with small endpoint The driver overrides the maximum transfer     size for a specific device which only accepts 16 byte packets for its 32 byte bulk-out endpoint. Make sure     to never increase the maximum transfer size to prevent slab corruption should a malicious device report a     smaller endpoint max packet size than expected. (CVE-2026-63898)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
349185	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4282-1)	Nessus	SuSE Local Security Checks	Local	high
347900	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4254-1)	Nessus	SuSE Local Security Checks	Local	high
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	Local	high
343358	Unity Linux 20.1050e Security Update: kernel (UTSA-2026-073353)	Nessus	Unity Linux Local Security Checks	Local	medium
343049	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500248)	Nessus	Oracle Linux Local Security Checks	Local	high
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
333941	Photon OS 5.0: Linux PHSA-2026-5.0-92-0926	Nessus	PhotonOS Local Security Checks	Local	high
333762	Photon OS 5.0: Linux PHSA-2026-5.0-92-0895	Nessus	PhotonOS Local Security Checks	Local	high
329326	Photon OS 5.0: Linux PHSA-2026-5.0-0926	Nessus	PhotonOS Local Security Checks	Local	high
328253	Linux Distros Unpatched Vulnerability : CVE-2026-63898	Nessus	Misc.	Local	high
325574	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-124 (ALASKERNEL-5.10-2026-124)	Nessus	Amazon Linux Local Security Checks	Local	high
322944	Photon OS 5.0: Linux PHSA-2026-5.0-0895	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2026-63898

medium

Tenable Plugins

high

high

high

medium

high

high

high

high

high

high

high

high

high