CVE-2026-68365

A flaw was found in the Linux kernel's io_edgeport USB serial driver. The driver fails to properly cap the transmit credits received from a connected USB device. This can lead to the txCredits value exceeding the allocated buffer size. A malicious USB device could leverage this vulnerability to trigger an out-of-bounds write in the ring buffer, potentially resulting in a denial of service or other memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the io_edgeport kernel module from being loaded by adding a configuration file under /etc/modprobe.d:

# echo "install io_edgeport /bin/true" > /etc/modprobe.d/disable-io_edgeport.conf

If the module is currently loaded in memory, unload it using:

# modprobe -r io_edgeport

If the module is in use and cannot be unloaded, a system reboot will be required to apply the configuration. Note that applying this workaround disables support for Edgeport USB serial adapters.