The Linux USB serial driver for digi_acceleport contains a flaw where the digi_write_inb_command() routine overwrites the transfer buffer when a write URB times out or when no timeout is specified, due to a missing return and incorrect jiffies comparison. This buffer corruption occurs entirely in kernel space and can corrupt kernel data structures, potentially leading to a kernel panic or system instability.

All Linux kernel versions that ship the digi_acceleport driver without the recent upstream commit fixes are impacted. The advisory does not specify a precise version range, but any kernel that contains the unpatched driver logic is susceptible until the kernel is updated to a release that includes the referenced patches. The affected product is the Linux operating system kernel. The vendor is Linux kernel maintainers and distribution‑specific kernel packages.

The CVSS score of 7.8 reflects a high severity, while the EPSS score below 1% suggests a low likelihood of current exploitation. The flaw is not listed in the CISA KEV catalog. Based on the description, it can be inferred that an attacker would need to supply a malicious USB device that triggers a write to a digi_acceleport device, causing the driver to corrupt the URB transfer buffer when a timeout occurs or when no timeout is set. Once this corruption occurs, the kernel may crash, resulting in a denial of service.