CVE-2026-64336: USB: serial: keyspan_pda: fix information leak
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: keyspanpda: fix information leak
The write() callback is supposed to return the number of characters accepted or a negative errno. Since the addition of write fifo support the keyspanpda implementation will however return the number characters submitted to the device if the write urb is not already in use. If this number is larger than the number of characters passed to write(), the line discipline continues writing data from beyond the tty write buffer.
Fix the information leak by making sure that keyspanpdawritestart() returns zero on success as intended.
Affected Software
Remediation
Event History
Frequently Asked Questions
What must an attacker be able to do to trigger this issue?
An attacker needs local access and low-privileged ability to write to a tty backed by the keyspan_pda USB serial driver. No user interaction is required.
What is the practical impact of successful exploitation?
The line discipline may continue writing data beyond the supplied tty write buffer, causing information to be submitted to the device. The CVSS vector indicates high availability impact, with no confidentiality or integrity impact recorded.
What should administrators do if they cannot apply the patch immediately?
Restrict untrusted local users from accessing tty devices associated with the keyspan_pda USB serial driver. This reduces the ability to invoke the affected write path.