CVE-2026-53195

Analyzed Analyzed - Analysis Complete

Heap Overflow in Linux Kernel USB Serial Driver

Publication date: 2026-06-25

Last updated on: 2026-07-06

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() build_i2c_fw_hdr() allocates a fixed-size buffer of (16*1024 - 512) + sizeof(struct ti_i2c_firmware_rec) bytes, then copies le16_to_cpu(img_header->Length) bytes into it without validating that Length fits within the available space after the firmware record header. img_header->Length is a __le16 from the firmware file and can be up to 65535. check_fw_sanity() validates the total firmware size but not img_header->Length specifically. Fix by rejecting images where img_header->Length exceeds the available destination space.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-07-06

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-53195

EUVD

EUVD-2026-39286

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	2.6.12
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.210 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.36 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.94 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.13 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 2.6.12.1 (inc) to 5.10.259 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's USB serial driver for Texas Instruments devices (io_ti). Specifically, the function build_i2c_fw_hdr() allocates a fixed-size buffer and then copies data into it based on a length value from the firmware file header without properly validating that this length fits within the allocated buffer.

Because the length field (img_header->Length) can be up to 65535 and is not specifically checked against the buffer size, it can cause a heap overflow by copying more data than the buffer can hold.

The vulnerability is fixed by rejecting firmware images where the length exceeds the available buffer space.

Impact Analysis

A heap overflow vulnerability like this can lead to memory corruption, which may be exploited by an attacker to execute arbitrary code, cause a denial of service (system crash), or escalate privileges on the affected system.

Since this vulnerability is in the Linux kernel USB serial driver, an attacker with access to the device or the ability to load malicious firmware could potentially exploit this flaw.

Mitigation Strategies

The vulnerability in the Linux kernel USB serial io_ti driver is fixed by rejecting firmware images where img_header->Length exceeds the available destination space.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

Hi! I’m here to help you understand CVE-2026-53195. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70