CVE-2026-63957

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: safe_serial: fix memory corruption with small endpoint

Make sure that the bulk-out buffer size is at least eight bytes to avoid
user-controlled slab corruption in "safe" mode should a malicious device
report a smaller size.