CVE-2026-64336

A flaw was found in the Linux kernel's keyspan_pda USB serial driver. An issue with the write() callback function allows it to report more data written than was actually provided. This can lead to the system writing data beyond its allocated buffer, resulting in an information leak. A local attacker could exploit this to potentially gain access to sensitive information.

This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux because exploitation requires local access and an attached or emulated Keyspan PDA USB serial adapter. While the out-of-bounds read in the driver could expose uninitialized or adjacent kernel memory over the serial interface, it does not grant direct privilege escalation or arbitrary code execution. Systems without this specific legacy hardware connected or virtualized are not exposed to the flaw during normal operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.