CVE-2026-64333: USB: serial: digi_acceleport: fix write buffer corruption
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: digiacceleport: fix write buffer corruption
The digiwriteinbcommand() is supposed to wait for the write urb to become available or return an error, but instead it updates the transfer buffer and tries to resubmit the urb on timeout.
To make things worse, for commands like break control where no timeout is used, the driver would corrupt the urb immediately due to a broken jiffies comparison (on 32-bit machines this takes five minutes of uptime to trigger due to INITIALJIFFIES).
Fix this by adding the missing return on timeout and waiting indefinitely when no timeout has been specified as intended.
This issue was (sort of) flagged by Sashiko when reviewing an unrelated change to the driver.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel digi_acceleport USB serial driver are the relevant population. The issue affects the driver's handling of write URBs for device commands.
What level of access is required for exploitation?
The CVSS vector indicates local access and low privileges are required, with no user interaction. It is not described as remotely exploitable in the provided data.
Are particular commands more likely to trigger the corruption?
Commands with no timeout, including break control, can corrupt the URB because of a broken jiffies comparison. On 32-bit systems, the description notes this condition can take five minutes of uptime to trigger due to INITIAL_JIFFIES.
What should be done to remediate the issue?
Apply the available patch. The fix returns an error when the write URB times out and waits indefinitely when no timeout was specified, preventing the erroneous buffer update and resubmission.