CVE-2026-53196: USB: serial: io_ti: fix heap overflow in get_manuf_info()
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: ioti: fix heap overflow in getmanufinfo()
getmanufinfo() reads le16tocpu(romdesc->Size) bytes from the device I2C EEPROM into a buffer allocated with kmallocobj(), which is sizeof(struct edgetimanufdescriptor) = 10 bytes.
The Size field comes from the device and is only validated (in checki2cimage()) to make sure the descriptor fits within TIMAXI2CSIZE (16384 bytes), not against the destination buffer size. A malicious USB device can therefore set Size to any value up to 16377, causing a heap overflow of up to 16367 bytes when plugged into a host running this driver.
validcsum() is called after readrom() and also iterates buffer[0..Size-1], compounding the out-of-bounds access.
Fix by rejecting descriptors with unexpected length before calling readrom().
[ johan: amend commit message; also check for short descriptors ]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Configuration
Before calling/reading descriptor data in get_manuf_info()/check_i2c_image(), reject any device-provided descriptor where the Size value (le16_to_cpu(rom_desc->Size)) would exceed the allocated destination buffer size; validate the descriptor fits before reading the rom_desc->Size bytes into the kmalloc_obj()-allocated buffer (instead of validating only against TI_MAX_I2C_SIZE=16384).
Linux kernel USB serial driver (USB: serial: io_ti: fix heap overflow in get_manuf_info()) Validate descriptor length before reading into heap buffer (get_manuf_info()/check_i2c_image()) = Reject descriptors with unexpected/oversized length where rom_desc->Size would not fit within the allocated buffer (including TI_MAX_I2C_SIZE=16384 and buffer sized to sizeof(struct edge_ti_manuf_descriptor)=10)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53196?
CVE-2026-53196 has a severity rating of high with a score of 7.8.
What type of vulnerability is CVE-2026-53196?
CVE-2026-53196 is a heap overflow vulnerability found in the Linux kernel's USB serial io_ti driver.
How do I fix CVE-2026-53196?
To mitigate CVE-2026-53196, update to the latest version of the Linux kernel where the vulnerability has been patched.
What platforms are affected by CVE-2026-53196?
CVE-2026-53196 affects the Linux kernel, specifically the USB serial io_ti driver.
What impact does CVE-2026-53196 have on systems?
CVE-2026-53196 can lead to potential information disclosure and denial of service due to the heap overflow.