{"id":"CVE-2026-53194","state":"PUBLISHED","title":"USB: serial: kl5kusb105: fix bulk-out buffer overflow","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: kl5kusb105: fix bulk-out buffer overflow\n\nklsi_105_prepare_write_buffer() is called by the generic write path\nwith the bulk-out buffer and its size (bulk_out_size, 64 bytes). It\nstores a two-byte length header at the start of the buffer and copies\nthe payload from the write fifo starting at buf + KLSI_HDR_LEN, but\npasses the full buffer size as the number of bytes to copy:\n\n  count = kfifo_out_locked(&port->write_fifo, buf + KLSI_HDR_LEN,\n                           size, &port->lock);\n\nWhen the fifo holds at least size bytes, size bytes are copied starting\ntwo bytes into the size-byte buffer, writing KLSI_HDR_LEN bytes past its\nend. Copy at most size - KLSI_HDR_LEN bytes instead, leaving room for\nthe header as safe_serial already does.\n\nWriting bulk_out_size or more bytes to the tty triggers a slab\nout-of-bounds write, observed with KASAN by emulating the device with\ndummy_hcd and raw-gadget:\n\n  BUG: KASAN: slab-out-of-bounds in kfifo_copy_out+0x83/0xc0\n  Write of size 64 at addr ffff888112c62202 by task python3\n   kfifo_copy_out\n   klsi_105_prepare_write_buffer [kl5kusb105]\n   usb_serial_generic_write_start [usbserial]\n  Allocated by task 139:\n   usb_serial_probe [usbserial]\n  The buggy address is located 2 bytes inside of allocated 64-byte region\n\nThe out-of-bounds write no longer occurs with this change applied.","publishedAt":"2026-06-25T08:39:05.017Z","updatedAt":"2026-10-19T19:57:28.103Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"60b3013cdaf3fa8a17243ca46b19db3cbe08d943","status":"affected","lessThan":"60af1fd82983c26604102e63a3fcc822c186cceb","versionType":"git"},{"version":"60b3013cdaf3fa8a17243ca46b19db3cbe08d943","status":"affected","lessThan":"0a57320f71941d4e0b1307453c9a1f0939afe666","versionType":"git"},{"version":"60b3013cdaf3fa8a17243ca46b19db3cbe08d943","status":"affected","lessThan":"14147b7963685957839c76ba8094924e22777d79","versionType":"git"},{"version":"60b3013cdaf3fa8a17243ca46b19db3cbe08d943","status":"affected","lessThan":"a1288cd700f721c1a119c4f1e8efa234e59caada","versionType":"git"},{"version":"60b3013cdaf3fa8a17243ca46b19db3cbe08d943","status":"affected","lessThan":"70d86e355c564b5510fde61361df014f5476c83e","versionType":"git"},{"version":"60b3013cdaf3fa8a17243ca46b19db3cbe08d943","status":"affected","lessThan":"372f33ebed747d91870f57c0a2e62884a870bffa","versionType":"git"},{"version":"60b3013cdaf3fa8a17243ca46b19db3cbe08d943","status":"affected","lessThan":"bde742b076cbe26ecc89c8c68c76ae076a524d02","versionType":"git"},{"version":"60b3013cdaf3fa8a17243ca46b19db3cbe08d943","status":"affected","lessThan":"96d47e40bf9db4a9efd5c8fb53287a508d165f14","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/serial/kl5kusb105.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.35","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.35","versionType":"semver"},{"version":"5.10.259","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.210","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.176","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.143","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.94","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.36","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.13","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/serial/kl5kusb105.c"]}],"references":["https://git.kernel.org/stable/c/60af1fd82983c26604102e63a3fcc822c186cceb","https://git.kernel.org/stable/c/0a57320f71941d4e0b1307453c9a1f0939afe666","https://git.kernel.org/stable/c/14147b7963685957839c76ba8094924e22777d79","https://git.kernel.org/stable/c/a1288cd700f721c1a119c4f1e8efa234e59caada","https://git.kernel.org/stable/c/70d86e355c564b5510fde61361df014f5476c83e","https://git.kernel.org/stable/c/372f33ebed747d91870f57c0a2e62884a870bffa","https://git.kernel.org/stable/c/bde742b076cbe26ecc89c8c68c76ae076a524d02","https://git.kernel.org/stable/c/96d47e40bf9db4a9efd5c8fb53287a508d165f14","https://access.redhat.com/security/cve/CVE-2026-53194","https://bugzilla.redhat.com/show_bug.cgi?id=2492703","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53194.json"],"weaknesses":["CWE-787"],"ingestedAt":"2026-10-29T20:12:16.098Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/53xxx/CVE-2026-53194.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-53194","state":"PUBLISHED","datePublished":"2026-06-25T08:39:05.017Z","dateUpdated":"2026-10-19T19:57:28.103Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-06-09T07:44:35.390Z"},"containers":{"cna":{"title":"USB: serial: kl5kusb105: fix bulk-out buffer overflow","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: kl5kusb105: fix bulk-out buffer overflow\n\nklsi_105_prepare_write_buffer() is called by the generic write path\nwith the bulk-out buffer and its size (bulk_out_size, 64 bytes). It\nstores a two-byte length header at the start of the buffer and copies\nthe payload from the write fifo starting at buf + KLSI_HDR_LEN, but\npasses the full buffer size as the number of bytes to copy:\n\n  count = kfifo_out_locked(&port->write_fifo, buf + KLSI_HDR_LEN,\n                           size, &port->lock);\n\nWhen the fifo holds at least size bytes, size bytes are copied starting\ntwo bytes into the size-byte buffer, writing KLSI_HDR_LEN bytes past its\nend. Copy at most size - KLSI_HDR_LEN bytes instead, leaving room for\nthe header as safe_serial already does.\n\nWriting bulk_out_size or more bytes to the tty triggers a slab\nout-of-bounds write, observed with KASAN by emulating the device with\ndummy_hcd and raw-gadget:\n\n  BUG: KASAN: slab-out-of-bounds in kfifo_copy_out+0x83/0xc0\n  Write of size 64 at addr ffff888112c62202 by task python3\n   kfifo_copy_out\n   klsi_105_prepare_write_buffer [kl5kusb105]\n   usb_serial_generic_write_start [usbserial]\n  Allocated by task 139:\n   usb_serial_probe [usbserial]\n  The buggy address is located 2 bytes inside of allocated 64-byte region\n\nThe out-of-bounds write no longer occurs with this change applied."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"60b3013cdaf3fa8a17243ca46b19db3cbe08d943","status":"affected","lessThan":"60af1fd82983c26604102e63a3fcc822c186cceb","versionType":"git"},{"version":"60b3013cdaf3fa8a17243ca46b19db3cbe08d943","status":"affected","lessThan":"0a57320f71941d4e0b1307453c9a1f0939afe666","versionType":"git"},{"version":"60b3013cdaf3fa8a17243ca46b19db3cbe08d943","status":"affected","lessThan":"14147b7963685957839c76ba8094924e22777d79","versionType":"git"},{"version":"60b3013cdaf3fa8a17243ca46b19db3cbe08d943","status":"affected","lessThan":"a1288cd700f721c1a119c4f1e8efa234e59caada","versionType":"git"},{"version":"60b3013cdaf3fa8a17243ca46b19db3cbe08d943","status":"affected","lessThan":"70d86e355c564b5510fde61361df014f5476c83e","versionType":"git"},{"version":"60b3013cdaf3fa8a17243ca46b19db3cbe08d943","status":"affected","lessThan":"372f33ebed747d91870f57c0a2e62884a870bffa","versionType":"git"},{"version":"60b3013cdaf3fa8a17243ca46b19db3cbe08d943","status":"affected","lessThan":"bde742b076cbe26ecc89c8c68c76ae076a524d02","versionType":"git"},{"version":"60b3013cdaf3fa8a17243ca46b19db3cbe08d943","status":"affected","lessThan":"96d47e40bf9db4a9efd5c8fb53287a508d165f14","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/serial/kl5kusb105.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.35","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.35","versionType":"semver"},{"version":"5.10.259","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.210","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.176","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.143","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.94","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.36","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.13","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/serial/kl5kusb105.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/60af1fd82983c26604102e63a3fcc822c186cceb"},{"url":"https://git.kernel.org/stable/c/0a57320f71941d4e0b1307453c9a1f0939afe666"},{"url":"https://git.kernel.org/stable/c/14147b7963685957839c76ba8094924e22777d79"},{"url":"https://git.kernel.org/stable/c/a1288cd700f721c1a119c4f1e8efa234e59caada"},{"url":"https://git.kernel.org/stable/c/70d86e355c564b5510fde61361df014f5476c83e"},{"url":"https://git.kernel.org/stable/c/372f33ebed747d91870f57c0a2e62884a870bffa"},{"url":"https://git.kernel.org/stable/c/bde742b076cbe26ecc89c8c68c76ae076a524d02"},{"url":"https://git.kernel.org/stable/c/96d47e40bf9db4a9efd5c8fb53287a508d165f14"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Although this is USB serial code, the vulnerable copy is reached by a local write to the registered /dev/ttyUSB device once a matching adapter is present.\nAC:L - Writing bulk_out_size or more bytes deterministically fills the FIFO and triggers the out-of-bounds copy; no race or attacker-uncontrolled timing is required.\nPR:L - There is no capability or authentication check in the tty/USB-serial write path, but the attacker needs local access to open and write the tty device.\nUI:N - The attacker can trigger the bug directly by writing to the tty device; no separate victim action is required.\nS:U - The corruption occurs within the host kernel and does not cross a VM, IOMMU, or similar security authority boundary.\nC:H - The bug is kernel heap memory corruption, and the overlong bulk-out URB may also expose adjacent heap bytes to the USB device.\nI:H - The attacker controls the data copied past the 64-byte bulk-out buffer, making this an out-of-bounds kernel heap write.\nA:H - The issue was observed as a KASAN slab out-of-bounds write and can reasonably cause kernel memory corruption, oops, or panic."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:34:00.760Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.35","versionEndExcluding":"5.10.259"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.35","versionEndExcluding":"5.15.210"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.35","versionEndExcluding":"6.1.176"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.35","versionEndExcluding":"6.6.143"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.35","versionEndExcluding":"6.12.94"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.35","versionEndExcluding":"6.18.36"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.35","versionEndExcluding":"7.0.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.35","versionEndExcluding":"7.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"kernel: USB: serial: kl5kusb105: fix bulk-out buffer overflow","descriptions":[{"lang":"en","value":"A flaw was found in the Linux kernel's `kl5kusb105` USB serial driver. This buffer overflow vulnerability allows a local attacker to write data beyond the intended memory boundary (if attacker controls USB device or driver, because triggered from the internals of the device). By sending a specially crafted input to the USB serial port, an attacker can trigger an out-of-bounds write, which may lead to memory corruption. The primary consequence of this flaw is a denial of service (DoS), potentially causing system instability or crashes."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"kernel","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"kernel","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"kernel","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"kernel-rt","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"kernel","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"kernel-rt","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"kernel","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"kernel-rt","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-53194","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492703","name":"RHBZ#2492703","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53194.json","tags":["x_sadp-csaf-vex"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Moderate"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","description":"Out-of-bounds Write","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-07-15T00:44:36.635Z"},"datePublic":"2026-06-25T00:00:00.000Z","timeline":[{"lang":"en","time":"2026-06-25T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-06-25T00:00:00.000Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"To mitigate this issue, prevent module kl5kusb105 from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-53194","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:26:39.976114Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","lang":"en","type":"CWE","description":"CWE-787 Out-of-bounds Write"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T19:57:28.103Z"}}]}}}