In the Linux kernel the keyspan_pda USB serial driver contains a flaw in its write() callback. When write FIFO support is enabled the function can return a count of bytes larger than the data actually sent, causing the line‑discipline code to read beyond the end of the tty write buffer. This out‑of‑bounds read leaks memory contents that were not intended for transmission, allowing an attacker to obtain sensitive data from the kernel or user space.

All Linux kernel builds that include the unpatched keyspan_pda driver are affected, including the 7.2 release candidates RC1 and RC2. Any system running such a kernel with the keyspan_pda module loaded—typically when a compatible USB serial device is connected—exposes the flaw.

The CVSS score of 5.5 characterizes the vulnerability as moderate in severity, and the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The flaw is listed as not being in CISA KEV, further suggesting limited real‑world impact. The likely attack vector is local physical access to a USB port that utilizes the keyspan_pda driver; remote exploitation is not supported. An adversary with such access could craft write operations to trigger the out‑of‑bounds read and exfiltrate kernel or user memory.