Executive brief
A vulnerability in the Linux kernel's KL5KUSB105 USB-to-serial driver could allow a local attacker or a malicious USB device to cause a system crash. The issue occurs when the driver incorrectly handles data being sent to the device, leading to a memory corruption event. This could disrupt system operations or potentially be used to gain further unauthorized access.
Technical details
A slab out-of-bounds write vulnerability exists in the kl5kusb105 USB serial driver within the klsi_105_prepare_write_buffer() function. The root cause is an incorrect length calculation when copying data from the write FIFO into the bulk-out buffer; the driver fails to account for a two-byte header (KLSI_HDR_LEN) when specifying the copy size to kfifo_out_locked(). An attacker can trigger this by writing 64 or more bytes to the associated TTY device, causing a 2-byte overflow beyond the allocated 64-byte slab region. This was verified using KASAN and dummy_hcd emulation. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 60b3013cdaf3 to 6.14
Timeline
- 2026-06-08: other: Vulnerability fixed in source code
- 2026-06-25: disclosed: CVE-2026-53194 published
References
- https://git.kernel.org/stable/c/0a57320f71941d4e0b1307453c9a1f0939afe666
- https://git.kernel.org/stable/c/14147b7963685957839c76ba8094924e22777d79
- https://git.kernel.org/stable/c/372f33ebed747d91870f57c0a2e62884a870bffa
- https://git.kernel.org/stable/c/60af1fd82983c26604102e63a3fcc822c186cceb
- https://git.kernel.org/stable/c/70d86e355c564b5510fde61361df014f5476c83e
- https://git.kernel.org/stable/c/96d47e40bf9db4a9efd5c8fb53287a508d165f14
- https://git.kernel.org/stable/c/a1288cd700f721c1a119c4f1e8efa234e59caada