CVE-2026-53194

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: kl5kusb105: fix bulk-out buffer overflow

klsi_105_prepare_write_buffer() is called by the generic write path

with the bulk-out buffer and its size (bulk_out_size, 64 bytes). It

stores a two-byte length header at the start of the buffer and copies

the payload from the write fifo starting at buf + KLSI_HDR_LEN, but

passes the full buffer size as the number of bytes to copy:

count = kfifo_out_locked(&port->write_fifo, buf + KLSI_HDR_LEN,

size, &port->lock);

When the fifo holds at least size bytes, size bytes are copied starting

two bytes into the size-byte buffer, writing KLSI_HDR_LEN bytes past its

end. Copy at most size - KLSI_HDR_LEN bytes instead, leaving room for

the header as safe_serial already does.

Writing bulk_out_size or more bytes to the tty triggers a slab

out-of-bounds write, observed with KASAN by emulating the device with

dummy_hcd and raw-gadget:

BUG: KASA

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References