Executive brief
A vulnerability in the Linux kernel's Digi Acceleport USB serial driver can cause a device to stop receiving data. If a communication port is closed while data flow is being restricted (throttled), the system fails to restart the data receiver when the port is reopened. This results in a loss of communication functionality that persists until the hardware is physically reconnected or the software driver is manually reloaded.
Technical details
A race condition or state management error exists in drivers/usb/serial/digi_acceleport.c where the read USB Request Block (URB) is not resubmitted if the port is closed while in a throttled state. When the port is subsequently reopened, the throttle flags remain set and the URB is not active, leading to a permanent 'broken' receive state for that session. The fix involves explicitly clearing throttle flags (dp_throttled and dp_throttle_restart) and resubmitting the read URB during the port open sequence (digi_open). This issue affects various stable branches of the Linux kernel and has been patched in multiple long-term support releases.
Affected products
- Linux Linux 2.6.12 to 5.10.261, 5.15.212, 6.1.178, 6.6.145
Timeline
- 2026-06-23: other: Patch authored
- 2026-07-24: patched: Patch committed to stable trees
- 2026-07-25: advisory: CVE published
References
- https://git.kernel.org/stable/c/4f3f6f44db71e469933a7c36c5d57d937ba0a21b
- https://git.kernel.org/stable/c/61954033326fc7e637ed2aeeb4b52021e0ee4657
- https://git.kernel.org/stable/c/83a3dfc018943b05b6daf3a6f891833e1aabfa1f
- https://git.kernel.org/stable/c/8d50a910194f66566a5eb252b33283855c8d5203
- https://git.kernel.org/stable/c/92fa3e1a49848509ea3f7995751963fc65095998
- https://git.kernel.org/stable/c/abacd67e6f689c62d8a13e3da25f4272bc9ad4af
- https://git.kernel.org/stable/c/d5d2660caef78d4c996d34d123574c8e86f5b5ac