Executive brief
A security vulnerability has been identified in the Linux kernel's USB serial driver for certain Texas Instruments devices. This flaw could allow a malicious actor with the ability to provide a specially crafted firmware file to cause a system crash or potentially execute unauthorized code. The issue affects how the system processes firmware updates for these specific USB-to-serial adapters.
Technical details
A heap-based buffer overflow exists in the build_i2c_fw_hdr() function within drivers/usb/serial/io_ti.c. The function allocates a fixed-size buffer but fails to validate the 'Length' field from the 'ti_i2c_image_header' struct, which is sourced directly from the firmware file. Since this field is a 16-bit little-endian value, it can specify a length up to 65535 bytes, exceeding the allocated destination space. An attacker providing a malicious firmware image could trigger an out-of-bounds write. Patches have been released across multiple stable kernel branches to enforce bounds checking against the available buffer size.
Affected products
- Linux Linux 2.6.12 through 6.14.y
Timeline
- 2026-05-25: other: Vulnerability fixed in source code by Adrian Korwel
- 2026-06-25: advisory: CVE-2026-53195 published by NVD
References
- https://git.kernel.org/stable/c/0fd2b00b2d3d05e3eaa13342b3dfb0fa85c226ae
- https://git.kernel.org/stable/c/130d6567eb148040eed1b73e1414ad6c27d22bd5
- https://git.kernel.org/stable/c/294692d3296eee3391c348d7ea6401916d27806c
- https://git.kernel.org/stable/c/2fd64bf0ad66ab5de0c73524591d879427ba5aba
- https://git.kernel.org/stable/c/3e187152f44d76d7633a3855ffd0099e1588b82a
- https://git.kernel.org/stable/c/4cb722747ed25971f35cc47ce5c0e79d7f717713
- https://git.kernel.org/stable/c/5a79b634ee58786ca627268daefa7744f2af2e14