The keyspan_pda USB serial driver in the Linux kernel contains a flaw in its write() callback: when the write FIFO support is enabled, the function may return the number of characters submitted to the device, rather than zero on success. If this number is larger than the length of the write buffer, the kernel’s line discipline continues to read data beyond the end of the tty write buffer. This overflow causes sensitive data that was not intended to be transmitted to leak to an attacker using the USB serial device. The defect is an out‑of‑bounds read and an excessive data disclosure. The resulting impact is that information from the host kernel can be exposed, potentially including kernel memory or user‑space data residing after the write buffer.

All Linux kernel configurations that load the keyspan_pda driver are potentially affected, regardless of specific kernel version, because the vulnerability exists in any build that contains the unpatched driver code.

The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating low exploitation probability. The flaw requires local physical access to a USB port and a connected serial device that uses the keyspan_pda driver, making it a local attack vector. Although it is not remotely exploitable through the network, the risk is moderate for systems that expose USB serial ports to untrusted users or environments where physical access cannot be guaranteed.