What is the CVSS score of CVE-2026-64333?

CVE-2026-64333 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64333?

Yes, a patch is available for CVE-2026-64333. Update the affected software to the latest version immediately.

Linux CVE-2026-64333

EUVD-2026-48877 HIGH

Out-of-bounds Write (CWE-787)

2026-07-25 Linux

GHSA-92hp-m55f-9hjw

Buffer Overflow Linux Memory Corruption

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 05:38 vuln.today

CVSS changed

Jul 27, 2026 - 05:22 NVD

7.8 (HIGH)

Patch available

Jul 25, 2026 - 11:18 EUVD

CVE Published

Jul 25, 2026 - 08:49 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 25, 2026 - 08:49 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: digi_acceleport: fix write buffer corruption

The digi_write_inb_command() is supposed to wait for the write urb to become available or return an error, but instead it updates the transfer buffer and tries to resubmit the urb on timeout.

To make things worse, for commands like break control where no timeout is used, the driver would corrupt the urb immediately due to a broken jiffies comparison (on 32-bit machines this takes five minutes of uptime to trigger due to INITIAL_JIFFIES).

Fix this by adding the missing return on timeout and waiting indefinitely when no timeout has been specified as intended.

This issue was (sort of) flagged by Sashiko when reviewing an unrelated change to the driver.

AnalysisAI

Local privilege escalation in the Linux kernel's digi_acceleport USB serial driver allows authenticated local users to corrupt kernel memory and execute arbitrary code as root. The vulnerability arises from a race condition in the digi_write_inb_command() function that mishandles timeouts and incorrectly updates transfer buffers, leading to write buffer corruption. No active exploitation has been reported, and publicly available exploit code has not been identified; a vendor patch is available across multiple stable kernel branches.

Same weakness CWE-787 – Out-of-bounds Write

View all

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2012-1889 HIGH POC

8.8

CVE-2010-3333 HIGH POC

7.8

CVE-2014-1761 HIGH POC

7.8

CVE-2009-3129 HIGH POC

7.8

CVE-2021-1732 HIGH POC

7.8

CVE-2013-3346 CRITICAL POC

9.8

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64333 vulnerability details – vuln.today

Back

Linux CVE-2026-64333

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Same weakness CWE-787 – Out-of-bounds Write

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code