CVE-2026-53196

USB: serial: io_ti: fix heap overflow in get_manuf_info()

State: Published
Severity: 6.8 Medium
Published: Jun 25, 2026
Updated: Sep 18, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: io_ti: fix heap overflow in get_manuf_info()

get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the device I2C EEPROM into a buffer allocated with kmalloc_obj(), which is sizeof(struct edge_ti_manuf_descriptor) = 10 bytes.

The Size field comes from the device and is only validated (in check_i2c_image()) to make sure the descriptor fits within TI_MAX_I2C_SIZE (16384 bytes), not against the destination buffer size. A malicious USB device can therefore set Size to any value up to 16377, causing a heap overflow of up to 16367 bytes when plugged into a host running this driver.

valid_csum() is called after read_rom() and also iterates buffer[0..Size-1], compounding the out-of-bounds access.

Fix by rejecting descriptors with unexpected length before calling read_rom().

[ johan: amend commit message; also check for short descriptors ]

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	redhat-SADP

Weaknesses

CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before e168db91442b94e64fa82a7dd297983d48ea5cc0Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 561edb021486e6723d841926aa4b48097da06190Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before cfd634f6dfd40c49a84f9bddc2867a80e2e2623aAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d92f17af7097d10bdeddf26f66f34b354104b277Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b849f30d1a9e66aae6b715aaef66e427390cb081Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f96cf7bf9fbf15d7fcf0c91fec47ba8a010369eaAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d214d2341d4f9f447e36a7d012cdf6a6631a55f1Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 183c1076eca43bbb3e7bdf597456f91d81c73e74Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.94 through 6.12.Not affected 6.18.36 through 6.18.Not affected 7.0.13 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before e168db91442b94e64fa82a7dd297983d48ea5cc0Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 561edb021486e6723d841926aa4b48097da06190Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before cfd634f6dfd40c49a84f9bddc2867a80e2e2623aAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d92f17af7097d10bdeddf26f66f34b354104b277Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b849f30d1a9e66aae6b715aaef66e427390cb081Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f96cf7bf9fbf15d7fcf0c91fec47ba8a010369eaAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d214d2341d4f9f447e36a7d012cdf6a6631a55f1Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 183c1076eca43bbb3e7bdf597456f91d81c73e74Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.94 through 6.12.*Not affected
6.18.36 through 6.18.*Not affected
7.0.13 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.