Executive brief
A vulnerability in the Linux kernel's USB serial driver could allow a malicious USB device to cause memory corruption. By connecting a specially crafted USB device that reports an unexpectedly small data buffer size, an attacker could crash the system or potentially execute unauthorized code. This issue primarily affects systems where untrusted physical USB devices can be connected.
Technical details
A vulnerability in drivers/usb/serial/safe_serial.c in the Linux kernel arises from a lack of boundary checking on the bulk-out buffer size. When the driver operates in 'safe' mode, it expects a buffer large enough to accommodate a two-byte trailer. A malicious USB device can provide a descriptor reporting a very small endpoint size (less than 8 bytes), leading to user-controlled slab corruption during write operations. The fix implements a minimum check of eight bytes for the bulk_out_size during the safe_startup sequence. This is a physical attack vector requiring the attachment of a malicious hardware device.
Affected products
- Linux Linux Kernel 2.6.12 to 6.6.143
Timeline
- 2026-05-22: other: Patch authored by Johan Hovold
- 2026-07-19: disclosed: CVE published by kernel.org
References
- https://git.kernel.org/stable/c/161ea0e5236f5f051d2d85d6c54dd08ee9dc7ba4
- https://git.kernel.org/stable/c/438061ed1ad85e6743e2dce826671772d81089ec
- https://git.kernel.org/stable/c/857b3cc73f91871ae4433f8b97c4670b78f8dc96
- https://git.kernel.org/stable/c/9b3145b3001fb24de1da72d1deb0bea70e5a078b
- https://git.kernel.org/stable/c/a550ed2117ca4709d38f713933ff924a83942e41
- https://git.kernel.org/stable/c/c7336c0fba5c959249f3d793d33076b992ec3ee4
- https://git.kernel.org/stable/c/e3a1d6eee25dc96b1d2db0ecd9d8741e92056476