Executive brief
A vulnerability in the Linux kernel's USB serial driver for Edgeport devices could allow a malicious USB device to crash the system or potentially execute unauthorized code. When a specially crafted USB device is plugged into a computer, it can provide a fake data size that overflows the computer's memory. This requires physical access to the machine to plug in the malicious device.
Technical details
A heap-based buffer overflow exists in the get_manuf_info() function within drivers/usb/serial/io_ti.c. The function reads a 'Size' field from the device's I2C EEPROM and uses it to copy data into a fixed-size 10-byte buffer (struct edge_ti_manuf_descriptor) without adequate bounds checking. While the size is validated against a maximum I2C limit (16384 bytes), it is not checked against the destination buffer size, allowing an overflow of up to 16367 bytes. An attacker with physical access can use a malicious USB device to trigger this overflow upon connection. The issue has been patched by adding a check to ensure the descriptor length matches the expected structure size.
Affected products
- Linux Linux Kernel 1da177e4c3f4 to 183c1076eca4 (and other stable branches)
Timeline
- 2026-05-25: other: Vulnerability fixed in source code by Adrian Korwel
- 2026-06-02: patched: Patch committed to stable tree by Johan Hovold
- 2026-06-25: disclosed: CVE-2026-53196 published
References
- https://git.kernel.org/stable/c/183c1076eca43bbb3e7bdf597456f91d81c73e74
- https://git.kernel.org/stable/c/561edb021486e6723d841926aa4b48097da06190
- https://git.kernel.org/stable/c/b849f30d1a9e66aae6b715aaef66e427390cb081
- https://git.kernel.org/stable/c/cfd634f6dfd40c49a84f9bddc2867a80e2e2623a
- https://git.kernel.org/stable/c/d214d2341d4f9f447e36a7d012cdf6a6631a55f1
- https://git.kernel.org/stable/c/d92f17af7097d10bdeddf26f66f34b354104b277
- https://git.kernel.org/stable/c/e168db91442b94e64fa82a7dd297983d48ea5cc0