CVE-2026-53194 - Vulnerability Details

- USB: serial: kl5kusb105: fix bulk-out buffer overflow

Description

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: kl5kusb105: fix bulk-out buffer overflow

klsi_105_prepare_write_buffer() is called by the generic write path
with the bulk-out buffer and its size (bulk_out_size, 64 bytes). It
stores a two-byte length header at the start of the buffer and copies
the payload from the write fifo starting at buf + KLSI_HDR_LEN, but
passes the full buffer size as the number of bytes to copy:

count = kfifo_out_locked(&port->write_fifo, buf + KLSI_HDR_LEN,
size, &port->lock);

When the fifo holds at least size bytes, size bytes are copied starting
two bytes into the size-byte buffer, writing KLSI_HDR_LEN bytes past its
end. Copy at most size - KLSI_HDR_LEN bytes instead, leaving room for
the header as safe_serial already does.

Writing bulk_out_size or more bytes to the tty triggers a slab
out-of-bounds write, observed with KASAN by emulating the device with
dummy_hcd and raw-gadget:

BUG: KASAN: slab-out-of-bounds in kfifo_copy_out+0x83/0xc0
Write of size 64 at addr ffff888112c62202 by task python3
kfifo_copy_out
klsi_105_prepare_write_buffer [kl5kusb105]
usb_serial_generic_write_start [usbserial]
Allocated by task 139:
usb_serial_probe [usbserial]
The buggy address is located 2 bytes inside of allocated 64-byte region

The out-of-bounds write no longer occurs with this change applied.

Published: 2026-06-25

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A bulk‑out buffer overflow flaw in the Linux kl5kusb105 USB serial driver allows a local attacker to write beyond the bounds of a 64‑byte buffer. The driver copies payload data into the buffer without accounting for a two‑byte header, resulting in a slab out‑of‑bounds write that can corrupt kernel memory. Such memory corruption can provide an attacker with the ability to execute arbitrary code with kernel privileges.

Affected Systems

The issue affects the kl5kusb105 USB serial driver in the Linux kernel. Any system running a kernel that has not incorporated the commit fixing the overflow is potentially vulnerable. No specific kernel version numbers are listed, so all releases containing the driver before the patch are at risk.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity vulnerability, while the EPSS score of <1% shows a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, requiring an attacker to interface with the USB serial device and transmit 64 or more bytes of data through the bulk‑out endpoint. Once triggered, the overflow can corrupt kernel memory, potentially allowing privilege escalation. The exploitability is limited to environments where the vulnerable driver is loaded and accessible.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`60b3013cdaf3fa8a17243ca46b19db3cbe08d943`	affected	< 60af1fd82983c26604102e63a3fcc822c186cceb
`60b3013cdaf3fa8a17243ca46b19db3cbe08d943`	affected	< 0a57320f71941d4e0b1307453c9a1f0939afe666
`60b3013cdaf3fa8a17243ca46b19db3cbe08d943`	affected	< 14147b7963685957839c76ba8094924e22777d79
`60b3013cdaf3fa8a17243ca46b19db3cbe08d943`	affected	< a1288cd700f721c1a119c4f1e8efa234e59caada
`60b3013cdaf3fa8a17243ca46b19db3cbe08d943`	affected	< 70d86e355c564b5510fde61361df014f5476c83e
`60b3013cdaf3fa8a17243ca46b19db3cbe08d943`	affected	< 372f33ebed747d91870f57c0a2e62884a870bffa
`60b3013cdaf3fa8a17243ca46b19db3cbe08d943`	affected	< bde742b076cbe26ecc89c8c68c76ae076a524d02
`60b3013cdaf3fa8a17243ca46b19db3cbe08d943`	affected	< 96d47e40bf9db4a9efd5c8fb53287a508d165f14

Linux

affected

Version	Status	Constraints
`2.6.35`	affected	—
`0`	unaffected	< 2.6.35
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.94`	unaffected	≤ 6.12.*
`6.18.36`	unaffected	≤ 6.18.*
`7.0.13`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[60b3013cdaf3fa8a17243ca46b19db3cbe08d943,60af1fd82983c26604102e63a3fcc822c186cceb)`	affected	code_commit	—
`[60b3013cdaf3fa8a17243ca46b19db3cbe08d943,0a57320f71941d4e0b1307453c9a1f0939afe666)`	affected	code_commit	—
`[60b3013cdaf3fa8a17243ca46b19db3cbe08d943,14147b7963685957839c76ba8094924e22777d79)`	affected	code_commit	—
`[60b3013cdaf3fa8a17243ca46b19db3cbe08d943,a1288cd700f721c1a119c4f1e8efa234e59caada)`	affected	code_commit	—
`[60b3013cdaf3fa8a17243ca46b19db3cbe08d943,70d86e355c564b5510fde61361df014f5476c83e)`	affected	code_commit	—
`[60b3013cdaf3fa8a17243ca46b19db3cbe08d943,372f33ebed747d91870f57c0a2e62884a870bffa)`	affected	code_commit	—
`[60b3013cdaf3fa8a17243ca46b19db3cbe08d943,bde742b076cbe26ecc89c8c68c76ae076a524d02)`	affected	code_commit	—
`[60b3013cdaf3fa8a17243ca46b19db3cbe08d943,96d47e40bf9db4a9efd5c8fb53287a508d165f14)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.35`	affected	semver	—
`[0,2.6.35)`	unaffected	semver	—
`[5.10.259,5.11.0)`	unaffected	semver	—
`[5.15.210,5.16.0)`	unaffected	semver	—
`[6.1.176,6.2.0)`	unaffected	semver	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.94,6.13.0)`	unaffected	semver	—
`[6.18.36,6.19.0)`	unaffected	semver	—
`[7.0.13,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the commit fixing the bulk‑out buffer overflow.
If a kernel update is not immediately possible, unload or disable the kl5kusb105 driver (for example, run 'modprobe -r kl5kusb105').
Restrict USB port usage or filter traffic so that only trusted USB devices can communicate with the system, and monitor for driver errors or memory corruption reports.

Generated by OpenCVE AI on June 28, 2026 at 14:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4664-1	linux security update
Debian DLA	DLA-4665-1	linux security update
Debian DLA	DLA-4671-1	linux-6.1 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00148.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0a57320f71941d4e0b1307453c9a1f0939afe666
https://git.kernel.org/stable/c/14147b7963685957839c76ba8094924e22777d79
https://git.kernel.org/stable/c/372f33ebed747d91870f57c0a2e62884a870bffa
https://git.kernel.org/stable/c/60af1fd82983c26604102e63a3fcc822c186cceb
https://git.kernel.org/stable/c/70d86e355c564b5510fde61361df014f5476c83e
https://git.kernel.org/stable/c/96d47e40bf9db4a9efd5c8fb53287a508d165f14
https://git.kernel.org/stable/c/a1288cd700f721c1a119c4f1e8efa234e59caada
https://git.kernel.org/stable/c/bde742b076cbe26ecc89c8c68c76ae076a524d02
https://lore.kernel.org/linux-cve-announce/2026062558-CVE-2026-53194-8cb6@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53194
https://www.cve.org/CVERecord?id=CVE-2026-53194

History

Sun, 28 Jun 2026 08:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Fri, 26 Jun 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-122

Fri, 26 Jun 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://lore.kernel.org/linux-cve-announce/2026062558-CVE-2026-53194-8cb6@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53194 https://www.cve.org/CVERecord?id=CVE-2026-53194
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Thu, 25 Jun 2026 11:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-122

Thu, 25 Jun 2026 09:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: USB: serial: kl5kusb105: fix bulk-out buffer overflow klsi_105_prepare_write_buffer() is called by the generic write path with the bulk-out buffer and its size (bulk_out_size, 64 bytes). It stores a two-byte length header at the start of the buffer and copies the payload from the write fifo starting at buf + KLSI_HDR_LEN, but passes the full buffer size as the number of bytes to copy: count = kfifo_out_locked(&port->write_fifo, buf + KLSI_HDR_LEN, size, &port->lock); When the fifo holds at least size bytes, size bytes are copied starting two bytes into the size-byte buffer, writing KLSI_HDR_LEN bytes past its end. Copy at most size - KLSI_HDR_LEN bytes instead, leaving room for the header as safe_serial already does. Writing bulk_out_size or more bytes to the tty triggers a slab out-of-bounds write, observed with KASAN by emulating the device with dummy_hcd and raw-gadget: BUG: KASAN: slab-out-of-bounds in kfifo_copy_out+0x83/0xc0 Write of size 64 at addr ffff888112c62202 by task python3 kfifo_copy_out klsi_105_prepare_write_buffer [kl5kusb105] usb_serial_generic_write_start [usbserial] Allocated by task 139: usb_serial_probe [usbserial] The buggy address is located 2 bytes inside of allocated 64-byte region The out-of-bounds write no longer occurs with this change applied.
Title		USB: serial: kl5kusb105: fix bulk-out buffer overflow
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0a57320f71941d4e0b1307453c9a1f0939afe666 https://git.kernel.org/stable/c/14147b7963685957839c76ba8094924e22777d79 https://git.kernel.org/stable/c/372f33ebed747d91870f57c0a2e62884a870bffa https://git.kernel.org/stable/c/60af1fd82983c26604102e63a3fcc822c186cceb https://git.kernel.org/stable/c/70d86e355c564b5510fde61361df014f5476c83e https://git.kernel.org/stable/c/96d47e40bf9db4a9efd5c8fb53287a508d165f14 https://git.kernel.org/stable/c/a1288cd700f721c1a119c4f1e8efa234e59caada https://git.kernel.org/stable/c/bde742b076cbe26ecc89c8c68c76ae076a524d02

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-25T08:39:05.017Z

Updated: 2026-07-15T00:44:36.635Z

Reserved: 2026-06-09T07:44:35.390Z

Link: CVE-2026-53194

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Important

Publid Date: 2026-06-25T00:00:00Z

Links: CVE-2026-53194 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-28T14:45:17Z

Weaknesses

CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object