CVE-2026-64333
Received Received - Intake

USB Serial Digi Acceleport Write Buffer Corruption

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: USB: serial: digi_acceleport: fix write buffer corruption The digi_write_inb_command() is supposed to wait for the write urb to become available or return an error, but instead it updates the transfer buffer and tries to resubmit the urb on timeout. To make things worse, for commands like break control where no timeout is used, the driver would corrupt the urb immediately due to a broken jiffies comparison (on 32-bit machines this takes five minutes of uptime to trigger due to INITIAL_JIFFIES). Fix this by adding the missing return on timeout and waiting indefinitely when no timeout has been specified as intended. This issue was (sort of) flagged by Sashiko when reviewing an unrelated change to the driver.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64333
EUVD
EUVD-2026-48877

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
digi acceleport *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a USB serial driver called digi_acceleport. The function digi_write_inb_command() fails to properly handle timeouts when writing data. Instead of waiting for the write operation to complete or returning an error, it incorrectly updates the transfer buffer and tries to resubmit the operation after a timeout. On 32-bit systems, a broken jiffies comparison could cause this issue to trigger after five minutes of uptime.

Detection Guidance

This vulnerability affects the Linux kernel's USB serial driver for Digi AccelePort devices. Detection requires checking if the affected driver (digi_acceleport) is loaded and examining kernel logs for write buffer corruption errors or urb submission failures. Commands like 'lsmod | grep digi_acceleport' can verify if the module is loaded. Kernel logs can be checked with 'dmesg | grep -i digi' or 'journalctl -k | grep -i digi' for errors related to urb corruption or timeouts.

Impact Analysis

This vulnerability could lead to data corruption or system instability when using USB serial devices with the affected digi_acceleport driver. It may cause write operations to fail or behave unpredictably, potentially disrupting communication with connected devices.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that includes the fix for CVE-2026-64333. If updating is not immediately possible, unloading the affected module with 'rmmod digi_acceleport' may prevent exploitation, but this could disrupt connected Digi AccelePort devices. Ensure no critical services rely on this driver until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64333. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart