CVE-2026-64336

Awaiting Analysis Awaiting Analysis - Queue

USB Serial Keyspan PDA Information Leak Vulnerability

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspan_pda: fix information leak The write() callback is supposed to return the number of characters accepted or a negative errno. Since the addition of write fifo support the keyspan_pda implementation will however return the number characters submitted to the device if the write urb is not already in use. If this number is larger than the number of characters passed to write(), the line discipline continues writing data from beyond the tty write buffer. Fix the information leak by making sure that keyspan_pda_write_start() returns zero on success as intended.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64336

EUVD

EUVD-2026-48880

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a USB serial driver called keyspan_pda. The issue is that the write() function incorrectly returns the number of characters submitted to the device instead of zero on success. This can cause the system to read and write data beyond the intended buffer, leading to an information leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's keyspan_pda USB serial driver and does not have network-based detection methods. Detection requires checking the kernel version and verifying if the affected driver is loaded. Use commands like 'uname -r' to check the kernel version and 'lsmod | grep keyspan' to see if the vulnerable module is loaded.

Impact Analysis

This vulnerability could allow unauthorized access to sensitive data in memory. If exploited, it might lead to information disclosure, where an attacker could read data they should not have access to. This could include passwords, encryption keys, or other confidential information.

Compliance Impact

This vulnerability involves an information leak in the Linux kernel's USB serial driver, where data from beyond the intended write buffer could be exposed. While not directly tied to GDPR or HIPAA, such leaks could potentially violate data protection principles under GDPR (e.g., unauthorized data exposure) or HIPAA (e.g., breaches of protected health information) if sensitive data were involved.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the vulnerability. If an update is not immediately available, consider disabling the keyspan_pda module by running 'modprobe -r keyspan' and blacklisting it in '/etc/modprobe.d/blacklist.conf'.

Hi! I’m here to help you understand CVE-2026-64336. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70