CVE-2026-53196Medium· 6.8▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the device I2C EEPROM into a buffer allocated w…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
0.3% → 0.3%
Last analysed / modified upstream
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: io_ti: fix heap overflow in get_manuf_info()
get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the device I2C EEPROM into a buffer allocated with kmalloc_obj(), which is sizeof(struct edge_ti_manuf_descriptor) = 10 bytes.
The Size field comes from the device and is only validated (in check_i2c_image()) to make sure the descriptor fits within TI_MAX_I2C_SIZE (16384 bytes), not against the destination buffer size. A malicious USB device can therefore set Size to any value up to 16377, causing a heap overflow of up to 16367 bytes when plugged into a host running this driver.
valid_csum() is called after read_rom() and also iterates buffer[0..Size-1], compounding the out-of-bounds access.
Fix by rejecting descriptors with unexpected length before calling read_rom().
[ johan: amend commit message; also check for short descriptors ]
linux_kernel >= 2.6.12.1, < 5.10.259linux_kernel >= 5.11, < 5.15.210linux_kernel >= 5.16, < 6.1.176linux_kernel >= 6.2, < 6.6.143linux_kernel >= 6.7, < 6.12.94linux_kernel >= 6.13, < 6.18.36linux_kernel >= 6.19, < 7.0.13linux_kernel = 2.6.12linux_kernel = 7.1Upgrade past the affected range:
linux_kernel 7.0.13Connected by shared product, vendor, weakness, or advisory.
CVE-2022-0500High· 7.8A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel’s BPF subsystem due to the way a user loads BTF
CVE-2020-14390Medium· 5.6A flaw was found in the Linux kernel in versions before 5.9-rc6
CVE-2020-36558Medium· 5.1A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and general protection fault.
CVE-2021-38198Medium· 5.5arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access permissions of a shadow page, leading to a missing guest protection page fault.
CVE-2020-36311Medium· 5.5An issue was discovered in the Linux kernel before 5.9
CVE-2020-10781Medium· 5.5A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory