---
id: CVE-2026-53194
title: 'USB: serial: kl5kusb105: fix bulk-out buffer overflow'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  USB: serial: kl5kusb105: fix bulk-out buffer overflow

  klsi_105_prepare_write_buffer() is called by the generic write path
  with the bulk-out buffer and its size (bulk_o…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 <
    60af1fd82983c26604102e63a3fcc822c186cceb
  - >-
    Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 <
    0a57320f71941d4e0b1307453c9a1f0939afe666
  - >-
    Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 <
    14147b7963685957839c76ba8094924e22777d79
  - >-
    Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 <
    a1288cd700f721c1a119c4f1e8efa234e59caada
  - >-
    Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 <
    70d86e355c564b5510fde61361df014f5476c83e
  - >-
    Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 <
    372f33ebed747d91870f57c0a2e62884a870bffa
  - >-
    Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 <
    bde742b076cbe26ecc89c8c68c76ae076a524d02
  - >-
    Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 <
    96d47e40bf9db4a9efd5c8fb53287a508d165f14
  - Linux 2.6.35
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:26:39.976114Z'
published: '2026-06-25'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:31:39.520Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53194'
references:
  - url: 'https://git.kernel.org/stable/c/60af1fd82983c26604102e63a3fcc822c186cceb'
  - url: 'https://git.kernel.org/stable/c/0a57320f71941d4e0b1307453c9a1f0939afe666'
  - url: 'https://git.kernel.org/stable/c/14147b7963685957839c76ba8094924e22777d79'
  - url: 'https://git.kernel.org/stable/c/a1288cd700f721c1a119c4f1e8efa234e59caada'
  - url: 'https://git.kernel.org/stable/c/70d86e355c564b5510fde61361df014f5476c83e'
  - url: 'https://git.kernel.org/stable/c/372f33ebed747d91870f57c0a2e62884a870bffa'
  - url: 'https://git.kernel.org/stable/c/bde742b076cbe26ecc89c8c68c76ae076a524d02'
  - url: 'https://git.kernel.org/stable/c/96d47e40bf9db4a9efd5c8fb53287a508d165f14'
tags:
  - cve.org
epss: 0.00148
epssPercentile: 0.03618
ingestedAt: '2026-10-16T17:24:46.736Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: kl5kusb105: fix bulk-out buffer overflow

klsi_105_prepare_write_buffer() is called by the generic write path
with the bulk-out buffer and its size (bulk_out_size, 64 bytes). It
stores a two-byte length header at the start of the buffer and copies
the payload from the write fifo starting at buf + KLSI_HDR_LEN, but
passes the full buffer size as the number of bytes to copy:

  count = kfifo_out_locked(&port->write_fifo, buf + KLSI_HDR_LEN,
                           size, &port->lock);

When the fifo holds at least size bytes, size bytes are copied starting
two bytes into the size-byte buffer, writing KLSI_HDR_LEN bytes past its
end. Copy at most size - KLSI_HDR_LEN bytes instead, leaving room for
the header as safe_serial already does.

Writing bulk_out_size or more bytes to the tty triggers a slab
out-of-bounds write, observed with KASAN by emulating the device with
dummy_hcd and raw-gadget:

  BUG: KASAN: slab-out-of-bounds in kfifo_copy_out+0x83/0xc0
  Write of size 64 at addr ffff888112c62202 by task python3
   kfifo_copy_out
   klsi_105_prepare_write_buffer [kl5kusb105]
   usb_serial_generic_write_start [usbserial]
  Allocated by task 139:
   usb_serial_probe [usbserial]
  The buggy address is located 2 bytes inside of allocated 64-byte region

The out-of-bounds write no longer occurs with this change applied.

## Affected

- `Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < 60af1fd82983c26604102e63a3fcc822c186cceb`
- `Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < 0a57320f71941d4e0b1307453c9a1f0939afe666`
- `Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < 14147b7963685957839c76ba8094924e22777d79`
- `Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < a1288cd700f721c1a119c4f1e8efa234e59caada`
- `Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < 70d86e355c564b5510fde61361df014f5476c83e`
- `Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < 372f33ebed747d91870f57c0a2e62884a870bffa`
- `Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < bde742b076cbe26ecc89c8c68c76ae076a524d02`
- `Linux >= 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 < 96d47e40bf9db4a9efd5c8fb53287a508d165f14`
- `Linux 2.6.35`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.