CVE-2026-64333

A flaw was found in the Linux kernel's digi_acceleport USB serial driver. This vulnerability allows a local attacker with access to the affected USB serial device to corrupt the write buffer due to improper handling of write operations and timeouts. This could lead to arbitrary code execution, allowing the attacker to run malicious code, or cause system instability and denial of service (DoS).

The digi_acceleport USB serial driver can corrupt the write URB transfer buffer because digi_write_inb_command may update and resubmit the buffer after a timeout while the URB is still marked in use. For commands without a timeout, a broken jiffies comparison can make the corruption happen immediately on 32 bit systems after the INITIAL_JIFFIES wrap related uptime condition. For the CVSS the PR:L is used because triggering requires local code or a local process with access to the affected USB serial tty, such as a user in the dialout group or a service account with device access. The issue is not network reachable and requires the specific USB serial driver and device path to be present. Impact is primarily integrity corruption of serial data or commands and denial of service for the affected device communication path, with no strong evidence of kernel privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.