CVE-2026-64333
USB: serial: digi_acceleport: fix write buffer corruption
Using Linux by Linux?
Get instant alerts when new vulnerabilities affect Linux - before attackers find them.
Description
In the Linux kernel, the following vulnerability has been resolved: USB: serial: digi_acceleport: fix write buffer corruption The digi_write_inb_command() is supposed to wait for the write urb to become available or return an error, but instead it updates the transfer buffer and tries to resubmit the urb on timeout. To make things worse, for commands like break control where no timeout is used, the driver would corrupt the urb immediately due to a broken jiffies comparison (on 32-bit machines this takes five minutes of uptime to trigger due to INITIAL_JIFFIES). Fix this by adding the missing return on timeout and waiting indefinitely when no timeout has been specified as intended. This issue was (sort of) flagged by Sashiko when reviewing an unrelated change to the driver.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- https://git.kernel.org/stable/c/5d9dc88bdf8897788b0eed57113e9eca7fd42ea9
- https://git.kernel.org/stable/c/2f296974acc279f05f284441bfe3064074958d11
- https://git.kernel.org/stable/c/e60e4873e9178da9f4f2674e4c2ff085d5a84f79
- https://git.kernel.org/stable/c/699dfb6917503b3cda4d5da6941cf79c3c1b4c8b
- https://git.kernel.org/stable/c/a274b3794fe1852c3d9fe6d900b94053c0b03410
References (8)
SSVC — Action Prioritization
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.