Skip to main content

Linux Kernel EUVDEUVD-2026-48880

| CVE-2026-64336 MEDIUM
Memory Leak (CWE-401)
2026-07-25 Linux GHSA-mhg5-fr5x-3g7c
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with physical Keyspan PDA hardware required (PR:L, AV:L); actual impact is kernel memory disclosure over USB (C:H), not an availability outage as the provided vector incorrectly states.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Sep 03, 2026 - 16:22 vuln.today
CVSS changed
Sep 03, 2026 - 16:07 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:50 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: keyspan_pda: fix information leak

The write() callback is supposed to return the number of characters accepted or a negative errno. Since the addition of write fifo support the keyspan_pda implementation will however return the number characters submitted to the device if the write urb is not already in use. If this number is larger than the number of characters passed to write(), the line discipline continues writing data from beyond the tty write buffer.

Fix the information leak by making sure that keyspan_pda_write_start() returns zero on success as intended.

AnalysisAI

The keyspan_pda USB-serial driver in the Linux kernel transmits kernel memory beyond the tty write buffer to an attached USB device due to an incorrect write() return value introduced with write FIFO support. After commit 034e38e8f687, the driver returns the byte count submitted to the USB device rather than the count accepted from the caller; the TTY line discipline interprets this inflated count as authorization to advance its read pointer past the buffer boundary, exposing adjacent kernel memory. Affected stable trees span Linux 5.15 through 7.1 and the 7.2-rc3 development branch, with patches released across all maintained stable series; no public exploit or active exploitation is confirmed, and EPSS is 0.21% (12th percentile).

Technical ContextAI

The vulnerability resides in drivers/usb/serial/keyspan_pda.c within keyspan_pda_write_start(). The TTY layer's write() interface requires callbacks to return the number of characters accepted from the caller or a negative errno. Following the addition of write FIFO support, the driver incorrectly returns the byte count submitted to the device via a USB URB, which can exceed the caller-supplied count. The TTY line discipline then reads from the caller's buffer using this inflated return value, causing it to consume kernel memory adjacent to the actual write buffer and transmit that memory over USB. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers all affected versions from 5.11 onward. The CWE-401 (Missing Release of Memory) assignment is a metadata error - no memory resource is unreleased; the correct classification is CWE-125 (Out-of-bounds Read) or CWE-200 (Information Exposure), as the bug causes an out-of-bounds read whose contents are then transmitted to an external device.

RemediationAI

Upgrade to a patched kernel release: 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, or any 7.2-rc3+ build. Fix commits for all maintained stable branches are available at kernel.org (https://git.kernel.org/stable/c/b069b7029862fafaff331d4c664d97d4ae828d6d and related links). For systems that do not require Keyspan PDA USB-serial hardware, the immediate compensating control is to blacklist the driver: run 'modprobe -r keyspan_pda' to unload it immediately and append 'blacklist keyspan_pda' to /etc/modprobe.d/blacklist.conf to prevent auto-loading on device plug-in; the trade-off is complete loss of Keyspan PDA serial functionality.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.7.20.8.150 Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.193 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.169 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.223 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.167 Affected
Image SLES-GCE-3P Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected

Share

EUVD-2026-48880 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy