In the Linux kernel’s USB serial io_edgeport driver, the code that processes returned transmit credits does not bound the 16‑bit credit value to the configured maximum. This mis‑boundary can inflate the internal txCredits counter beyond maxTxCredits. When the driver later calculates how much data fits into the FIFO ring buffer, the inflated counter causes an out‑of‑bounds write, corrupting kernel memory and potentially leading to a crash. The weakness matches classic buffer‑overflow flaws, identified as CWE‑787.

All systems running a Linux kernel that includes the io_edgeport USB serial driver and that haven’t applied the upstream patch are affected. The driver is bundled with the standard kernel in every major distribution, so virtually all current kernel releases prior to the fix are vulnerable. Affected version details are not available in the CVE data.

The CVSS score of 5.5 indicates medium severity, and the EPSS score of <1% shows a very low, but not zero, likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Since the flaw is triggered by a USB device that reports oversized transmit credits, an attacker would need physical access or the ability to replace a legitimate device. No public exploit is known, and exploiting the issue would require a carefully crafted USB traffic sequence to trigger the overflow.