CVE-2026-53195
Received Received - Intake
Heap Overflow in Linux Kernel USB Serial Driver

Publication date: 2026-06-25

Last updated on: 2026-06-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() build_i2c_fw_hdr() allocates a fixed-size buffer of (16*1024 - 512) + sizeof(struct ti_i2c_firmware_rec) bytes, then copies le16_to_cpu(img_header->Length) bytes into it without validating that Length fits within the available space after the firmware record header. img_header->Length is a __le16 from the firmware file and can be up to 65535. check_fw_sanity() validates the total firmware size but not img_header->Length specifically. Fix by rejecting images where img_header->Length exceeds the available destination space.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-25
Last Modified
2026-06-25
Generated
2026-06-25
AI Q&A
2026-06-25
EPSS Evaluated
N/A
NVD
CVE-2026-53195
EUVD
EUVD-2026-39286
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's USB serial driver for Texas Instruments devices (io_ti). Specifically, the function build_i2c_fw_hdr() allocates a fixed-size buffer and then copies data into it based on a length value from the firmware file header without properly validating that this length fits within the allocated buffer.

Because the length field (img_header->Length) can be up to 65535 and is not specifically checked against the buffer size, it can cause a heap overflow by copying more data than the buffer can hold.

The vulnerability is fixed by rejecting firmware images where the length exceeds the available buffer space.

Impact Analysis

A heap overflow vulnerability like this can lead to memory corruption, which may be exploited by an attacker to execute arbitrary code, cause a denial of service (system crash), or escalate privileges on the affected system.

Since this vulnerability is in the Linux kernel USB serial driver, an attacker with access to the device or the ability to load malicious firmware could potentially exploit this flaw.

Mitigation Strategies

The vulnerability in the Linux kernel USB serial io_ti driver is fixed by rejecting firmware images where img_header->Length exceeds the available destination space.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53195. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart