A heap overflow exists in the USB serial io_ti driver when it constructs firmware headers. The function allocates a fixed-size buffer and then copies a length field from the firmware image without ensuring the length fits within the remaining space. If an attacker supplies firmware where the length exceeds the allowed area, the copy will overwrite adjacent heap memory. This memory corruption can be exploited to inject code or modify kernel data structures, potentially leading to remote execution of arbitrary code or privilege escalation if the vulnerable kernel processes the crafted firmware.

The issue affects all Linux kernel builds that implement the io_ti USB serial driver before the patch that hashes the firmware header length check is applied. The vulnerability is relevant to generic Linux distributions and any system that uses the kernel version containing the vulnerable driver. Exact version numbers are not specified in the data, so all pre‑patch kernel releases are considered at risk.

Because the flaw occurs in kernel space, exploitation can allow arbitrary code execution with kernel privileges. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but the CVSS score is not reported either. The usual attack vector would be a malicious USB device delivering a crafted firmware image to the host. Successful exploitation would require that the host accepts and processes the firmware before the kernel patch is applied, making it a serious risk for systems exposed to untrusted USB devices.