Executive brief
A vulnerability in the Linux kernel's Digi Acceleport USB serial driver could allow a malicious USB device to cause memory corruption. By reporting unexpectedly small buffer sizes, a connected device can trigger out-of-bounds memory access, potentially leading to a system crash or unauthorized code execution. This requires physical access to plug a malicious device into the affected system.
Technical details
A vulnerability exists in the 'digi_acceleport' USB serial driver within the Linux kernel (specifically in 'drivers/usb/serial/digi_acceleport.c'). The driver fails to perform adequate sanity checks on the bulk-out buffer sizes reported by a connected USB device. An attacker with physical access could connect a specially crafted USB device that reports smaller-than-expected buffer sizes, triggering out-of-bounds memory accesses or slab corruption during the 'digi_startup' process. This can lead to a denial of service (system crash) or potentially arbitrary code execution in the context of the kernel. The issue has been addressed by adding checks to ensure buffers are large enough for headers and command data.
Affected products
- Linux Linux 2.6.12 to 5.10.259, 5.15.210, 6.1.176, 6.6.143
Timeline
- 2026-06-04: other: Patch authored
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/062dcc0b324afd03b1406f157190804f105718bb
- https://git.kernel.org/stable/c/25b93d0f229a115ab120106f37b9454170d4cfd4
- https://git.kernel.org/stable/c/41b645e791099f0038225da5e2ca3ca31f00d435
- https://git.kernel.org/stable/c/6ab1e9ae099577a1019312088309ecbad2da9a91
- https://git.kernel.org/stable/c/8a65db5edd7b63365e9c5b7d9f4b8f314696dc49
- https://git.kernel.org/stable/c/9469419b12a100e7e2ccdda64ab45b8368456c8a
- https://git.kernel.org/stable/c/cb3560e8eab1dfa1cac1ed52631adf8ec6ff2cd5