In the Linux kernel, the following vulnerability has been resolved: USB: serial: belkin_sa: validate interrupt status length The Belkin interrupt callback treats interrupt data as a four-byte status report and reads LSR/MSR fields at offsets 2 and 3. The interrupt-in buffer length is derived from endpoint wMaxPacketSize, and short interrupt transfers may complete successfully with a smaller actual_length. Check the completed interrupt packet length before parsing status fields so short interrupt endpoints and short successful packets are ignored instead of causing out-of-bounds or stale status-byte reads. KASAN report as below: BUG: KASAN: slab-out-of-bounds in belkin_sa_read_int_callback() Read of size 1 Call trace: belkin_sa_read_int_callback() (drivers/usb/serial/belkin_sa.c:202) __usb_hcd_giveback_urb() (drivers/usb/core/hcd.c:1630) dummy_timer() (?:?)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-073375 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    USB: serial: belkin_sa: validate interrupt status length

    The Belkin interrupt callback treats interrupt data as a four-byte     status report and reads LSR/MSR fields at offsets 2 and 3. The     interrupt-in buffer length is derived from endpoint wMaxPacketSize, and     short interrupt transfers may complete successfully with a smaller     actual_length.

    Check the completed interrupt packet length before parsing status     fields so short interrupt endpoints and short successful packets are     ignored instead of causing out-of-bounds or stale status-byte reads.

    KASAN report as below:

    BUG: KASAN: slab-out-of-bounds in belkin_sa_read_int_callback()     Read of size 1     Call trace:
      belkin_sa_read_int_callback() (drivers/usb/serial/belkin_sa.c:202)
      __usb_hcd_giveback_urb() (drivers/usb/core/hcd.c:1630)       dummy_timer() (?:?)

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - USB: serial: belkin_sa: validate interrupt status length The Belkin interrupt callback treats interrupt     data as a four-byte status report and reads LSR/MSR fields at offsets 2 and 3. The interrupt-in buffer     length is derived from endpoint wMaxPacketSize, and short interrupt transfers may complete successfully     with a smaller actual_length. Check the completed interrupt packet length before parsing status fields so     short interrupt endpoints and short successful packets are ignored instead of causing out-of-bounds or     stale status-byte reads. KASAN report as below: BUG: KASAN: slab-out-of-bounds in     belkin_sa_read_int_callback() Read of size 1 Call trace: belkin_sa_read_int_callback()     (drivers/usb/serial/belkin_sa.c:202) __usb_hcd_giveback_urb() (drivers/usb/core/hcd.c:1630) dummy_timer()     (?:?) (CVE-2026-63903)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	Local	high
343330	Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: kernel (UTSA-2026-073375)	Nessus	Unity Linux Local Security Checks	Local	medium
343049	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500248)	Nessus	Oracle Linux Local Security Checks	Local	high
341024	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3790-1)	Nessus	SuSE Local Security Checks	Local	high
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	Local	high
333941	Photon OS 5.0: Linux PHSA-2026-5.0-92-0926	Nessus	PhotonOS Local Security Checks	Local	high
333762	Photon OS 5.0: Linux PHSA-2026-5.0-92-0895	Nessus	PhotonOS Local Security Checks	Local	high
329326	Photon OS 5.0: Linux PHSA-2026-5.0-0926	Nessus	PhotonOS Local Security Checks	Local	high
328270	Linux Distros Unpatched Vulnerability : CVE-2026-63903	Nessus	Misc.	Local	medium
325574	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-124 (ALASKERNEL-5.10-2026-124)	Nessus	Amazon Linux Local Security Checks	Local	high
322944	Photon OS 5.0: Linux PHSA-2026-5.0-0895	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2026-63903

medium

Tenable Plugins

high

medium

high

high

high

high

high

high

high

high

medium

high

high