Executive brief
A vulnerability in the Linux kernel's Keyspan USB-to-serial driver could allow an attacker to access sensitive information from the system's memory. This occurs because the driver incorrectly handles data transmission, potentially leaking data from beyond the intended communication buffer. This could lead to the exposure of private system information to unauthorized local users.
Technical details
An information leak exists in drivers/usb/serial/keyspan_pda.c within the Linux kernel. The keyspan_pda_write_start() function incorrectly returns the number of characters submitted to the device instead of zero on success. When this returned value is larger than the actual number of characters passed to the write() system call, the TTY line discipline continues reading and transmitting data from memory beyond the intended write buffer. This allows a local attacker to leak kernel memory contents to a connected USB serial device. The issue was introduced by the addition of write-fifo support and has been fixed by ensuring the function returns zero on success.
Affected products
- Linux Linux 5.11 to 5.15.212, 6.1.178, 6.6.145, 6.12.96
Timeline
- 2026-06-29: other: Vulnerability fixed in kernel source
- 2026-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/2f7a6b8ab3845bd1da02604f1a874b52a4555a72
- https://git.kernel.org/stable/c/6bfc8d01ac4068eced509f8fc74d0cd205e4dcec
- https://git.kernel.org/stable/c/b069b7029862fafaff331d4c664d97d4ae828d6d
- https://git.kernel.org/stable/c/cf6ca0aefae03958cfb5b189b0adbfb25c06bfac
- https://git.kernel.org/stable/c/d4b12b6b395e43a2b1d80be3745631fcaa9c047b
- https://git.kernel.org/stable/c/e1494191a3aac665d3a2fce16169a97c346253ec
- https://git.kernel.org/stable/c/e52ca411f50539ff1d0c877b9312771ca8a858c1