A flaw in the Linux kernel’s safe_serial USB serial driver allows a connected device to report a bulk‑out endpoint size smaller than eight bytes. This is a CWE‑131 heap buffer overflow. The driver does not check that the requested buffer size meets this minimum, which results in a heap memory corruption that can overwrite adjacent kernel memory. If the attacker controls the payload, this may lead to arbitrary code execution or privilege escalation.

All Linux kernel versions that include the vulnerable safe_serial implementation before the fix commit. The vulnerable code resides in the USB serial subsystem; any kernel lacking the bulk‑out size check is at risk.

The CVSS score of 7.0 indicates medium severity, while the EPSS score of less than 1% suggests a low current probability of exploitation. This vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the bug is activated only when a malicious USB device reports a small endpoint size and an attacker must be able to connect such a device, implying physical or local access. If exploited, the resulting heap overflow could be leveraged for arbitrary code execution.