{"id":"CVE-2026-53194","title":"USB: serial: kl5kusb105: fix bulk-out buffer overflow","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: kl5kusb105: fix bulk-out buffer overflow\n\nklsi_105_prepare_write_buffer() is called by the generic write path\nwith the bulk-out buffer and its size (bulk_o…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < 60af1fd82983c26604102e63a3fcc822c186cceb","Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < 0a57320f71941d4e0b1307453c9a1f0939afe666","Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < 14147b7963685957839c76ba8094924e22777d79","Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < a1288cd700f721c1a119c4f1e8efa234e59caada","Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < 70d86e355c564b5510fde61361df014f5476c83e","Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < 372f33ebed747d91870f57c0a2e62884a870bffa","Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < bde742b076cbe26ecc89c8c68c76ae076a524d02","Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < 96d47e40bf9db4a9efd5c8fb53287a508d165f14","Linux 2.6.35"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:26:39.976114Z"},"published":"2026-06-25","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:31:39.520Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53194","references":[{"url":"https://git.kernel.org/stable/c/60af1fd82983c26604102e63a3fcc822c186cceb"},{"url":"https://git.kernel.org/stable/c/0a57320f71941d4e0b1307453c9a1f0939afe666"},{"url":"https://git.kernel.org/stable/c/14147b7963685957839c76ba8094924e22777d79"},{"url":"https://git.kernel.org/stable/c/a1288cd700f721c1a119c4f1e8efa234e59caada"},{"url":"https://git.kernel.org/stable/c/70d86e355c564b5510fde61361df014f5476c83e"},{"url":"https://git.kernel.org/stable/c/372f33ebed747d91870f57c0a2e62884a870bffa"},{"url":"https://git.kernel.org/stable/c/bde742b076cbe26ecc89c8c68c76ae076a524d02"},{"url":"https://git.kernel.org/stable/c/96d47e40bf9db4a9efd5c8fb53287a508d165f14"}],"tags":["cve.org"],"epss":0.00148,"epssPercentile":0.03618,"ingestedAt":"2026-10-16T17:24:46.736Z","slug":"CVE-2026-53194","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: kl5kusb105: fix bulk-out buffer overflow\n\nklsi_105_prepare_write_buffer() is called by the generic write path\nwith the bulk-out buffer and its size (bulk_out_size, 64 bytes). It\nstores a two-byte length header at the start of the buffer and copies\nthe payload from the write fifo starting at buf + KLSI_HDR_LEN, but\npasses the full buffer size as the number of bytes to copy:\n\n  count = kfifo_out_locked(&port->write_fifo, buf + KLSI_HDR_LEN,\n                           size, &port->lock);\n\nWhen the fifo holds at least size bytes, size bytes are copied starting\ntwo bytes into the size-byte buffer, writing KLSI_HDR_LEN bytes past its\nend. Copy at most size - KLSI_HDR_LEN bytes instead, leaving room for\nthe header as safe_serial already does.\n\nWriting bulk_out_size or more bytes to the tty triggers a slab\nout-of-bounds write, observed with KASAN by emulating the device with\ndummy_hcd and raw-gadget:\n\n  BUG: KASAN: slab-out-of-bounds in kfifo_copy_out+0x83/0xc0\n  Write of size 64 at addr ffff888112c62202 by task python3\n   kfifo_copy_out\n   klsi_105_prepare_write_buffer [kl5kusb105]\n   usb_serial_generic_write_start [usbserial]\n  Allocated by task 139:\n   usb_serial_probe [usbserial]\n  The buggy address is located 2 bytes inside of allocated 64-byte region\n\nThe out-of-bounds write no longer occurs with this change applied.\n\n## Affected\n\n- `Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < 60af1fd82983c26604102e63a3fcc822c186cceb`\n- `Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < 0a57320f71941d4e0b1307453c9a1f0939afe666`\n- `Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < 14147b7963685957839c76ba8094924e22777d79`\n- `Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < a1288cd700f721c1a119c4f1e8efa234e59caada`\n- `Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < 70d86e355c564b5510fde61361df014f5476c83e`\n- `Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < 372f33ebed747d91870f57c0a2e62884a870bffa`\n- `Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < bde742b076cbe26ecc89c8c68c76ae076a524d02`\n- `Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < 96d47e40bf9db4a9efd5c8fb53287a508d165f14`\n- `Linux 2.6.35`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}