Junglewise Threat Intelligence

CVE-2026-53196: Linux Kernel heap overflow in USB serial io_ti driver

CVE-2026-53196 · Severity: info · CVSS 6.8 · Published 2026-06-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's USB serial driver for Edgeport devices could allow a malicious USB device to crash the system or potentially execute unauthorized code. When a specially crafted USB device is plugged into a computer, it can provide a fake data size that overflows the computer's memory. This requires physical access to the machine to plug in the malicious device.

Technical details

A heap-based buffer overflow exists in the get_manuf_info() function within drivers/usb/serial/io_ti.c. The function reads a 'Size' field from the device's I2C EEPROM and uses it to copy data into a fixed-size 10-byte buffer (struct edge_ti_manuf_descriptor) without adequate bounds checking. While the size is validated against a maximum I2C limit (16384 bytes), it is not checked against the destination buffer size, allowing an overflow of up to 16367 bytes. An attacker with physical access can use a malicious USB device to trigger this overflow upon connection. The issue has been patched by adding a check to ensure the descriptor length matches the expected structure size.

Affected products

  • Linux Linux Kernel 1da177e4c3f4 to 183c1076eca4 (and other stable branches)

Timeline

  • 2026-05-25: other: Vulnerability fixed in source code by Adrian Korwel
  • 2026-06-02: patched: Patch committed to stable tree by Johan Hovold
  • 2026-06-25: disclosed: CVE-2026-53196 published

References

Related threats