CVE-2026-68365
Received Received - Intake

USB: serial: io_edgeport Out-of-Bounds Write in Ring Buffer

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_edgeport: cap received transmit credits The interrupt-status packet reports transmit credits returned by the device. edge_interrupt_callback() adds the 16-bit value to txCredits without checking maxTxCredits. edge_write() uses txCredits minus the software FIFO count as the amount of data that fits. Since the FIFO is allocated with maxTxCredits bytes, txCredits exceeding maxTxCredits can cause OOB write in ring buffer. Cap accumulated credits at maxTxCredits. Conforming devices should never hit the cap.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68365
EUVD
EUVD-2026-55466

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the USB serial driver io_edgeport. The issue occurs when the device reports transmit credits back to the system. The system adds these credits to a counter without checking the maximum allowed value. This can lead to the counter exceeding the allocated buffer size, causing an out-of-bounds write in the ring buffer.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB serial driver (io_edgeport). Detection requires checking kernel logs for errors related to the io_edgeport module or USB serial devices. Monitor for OOB write errors or txCredits overflows in system logs. No direct network detection commands are applicable as this is a local kernel issue.

Impact Analysis

This vulnerability could allow an attacker with physical access to a system to trigger memory corruption, potentially leading to system crashes, privilege escalation, or arbitrary code execution. It may also cause data corruption or instability in USB serial communication devices.

Mitigation Strategies

Apply the latest Linux kernel updates to patch this vulnerability. If immediate patching is not possible, consider disabling the io_edgeport module if not in use. Monitor kernel logs for signs of exploitation or abnormal behavior in USB serial devices.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68365. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart