Skip to main content

Linux Kernel CVE-2026-53195

| EUVDEUVD-2026-39286 HIGH
Out-of-bounds Write (CWE-787)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-397c-7vfx-vg4x
Buffer Overflow Linux Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local trigger via firmware image with low privilege (PR:L) and no user interaction; kernel heap overflow yields full C/I/A impact, matching the published 7.8 rating.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.8 MEDIUM
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 06, 2026 - 12:38 vuln.today
CVSS changed
Jul 06, 2026 - 12:37 NVD
7.8 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()

build_i2c_fw_hdr() allocates a fixed-size buffer of (16*1024 - 512) + sizeof(struct ti_i2c_firmware_rec) bytes, then copies le16_to_cpu(img_header->Length) bytes into it without validating that Length fits within the available space after the firmware record header.

img_header->Length is a __le16 from the firmware file and can be up to 65535. check_fw_sanity() validates the total firmware size but not img_header->Length specifically.

Fix by rejecting images where img_header->Length exceeds the available destination space.

AnalysisAI

Kernel-level heap buffer overflow (out-of-bounds write) in the Linux kernel's io_ti USB-serial driver (used by Digi Edgeport TI-based USB serial adapters) allows a local low-privileged attacker or a malicious/crafted firmware image to corrupt kernel heap memory. The flaw lives in build_i2c_fw_hdr(), which copies an attacker-influenced 16-bit Length field (up to 65535) from the firmware image into a fixed-size buffer without validating it fits the remaining space after the ti_i2c_firmware_rec header. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not on the CISA KEV list, so exploitation is theoretical rather than observed.

Technical ContextAI

The affected code is drivers/usb/serial/io_ti.c, the driver for Inside Out Networks / Digi Edgeport USB-to-serial converters built on Texas Instruments controllers. During firmware download the driver parses an I2C firmware image (struct ti_i2c_firmware_rec plus a ti_i2c_image_header). build_i2c_fw_hdr() allocates a fixed buffer of (16*1024 - 512) + sizeof(struct ti_i2c_firmware_rec) bytes and then memcpy-style copies le16_to_cpu(img_header->Length) bytes into it. check_fw_sanity() validated the overall firmware size but never bounded img_header->Length against the destination capacity, so a Length larger than the available space writes past the allocation. This is a classic CWE-787 out-of-bounds write leading to kernel heap corruption / memory corruption (per the Buffer Overflow, Memory Corruption tags). The CPE data lists cpe:2.3:o:linux:linux_kernel across a broad range from 2.6.12 onward, reflecting the code's long presence in the tree.

RemediationAI

Apply your distribution's kernel update or upgrade to a fixed stable release: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1 or later (Vendor-released patch: these stable versions; upstream fix available as commits at git.kernel.org/stable such as 0fd2b00b2d3d and 130d6567eb14). The fix rejects firmware images whose img_header->Length exceeds the available destination space. If you cannot patch immediately and do not use Edgeport TI USB serial adapters, prevent the driver from loading by blacklisting it (add 'blacklist io_ti' plus 'install io_ti /bin/true' in /etc/modprobe.d/), which eliminates the attack surface at the cost of losing support for those specific adapters; also enforce USB device authorization / port-access controls (e.g. USBGuard or disabling unused USB ports) to block rogue devices that impersonate an Edgeport converter, at the cost of added administrative overhead for legitimate USB use. Reference the advisories at https://nvd.nist.gov/vuln/detail/CVE-2026-53195 and https://vuldb.com/vuln/373755.

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

Share

CVE-2026-53195 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy