CVE-2026-53194

A flaw was found in the Linux kernel's kl5kusb105 USB serial driver. This buffer overflow vulnerability allows a local attacker to write data beyond the intended memory boundary (if attacker controls USB device or driver, because triggered from the internals of the device). By sending a specially crafted input to the USB serial port, an attacker can trigger an out-of-bounds write, which may lead to memory corruption. The primary consequence of this flaw is a denial of service (DoS), potentially causing system instability or crashes.

A slab out of bounds write in the USB serial kl5kusb105 transmit path occurs because klsi_105_prepare_write_buffer copies up to the full bulk out buffer size into dest plus KLSI_HDR_LEN, leaving no room for the two byte header. A local user or process that can write bulk_out_size or more bytes to the matching tty device can overflow the 64 byte bulk out buffer by KLSI_HDR_LEN bytes and corrupt adjacent slab memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module kl5kusb105 from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.