Orta CVSS 6.8

CVE-2026-53196: Linux Kernel: sınır dışı yazma

Yayın: 25 Haziran 2026 12:16 · Güncelleme: 6 Kasım 2026 20:30

Açıklama (NVD)

In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the device I2C EEPROM into a buffer allocated with kmalloc_obj(), which is sizeof(struct edge_ti_manuf_descriptor) = 10 bytes. The Size field comes from the device and is only validated (in check_i2c_image()) to make sure the descriptor fits within TI_MAX_I2C_SIZE (16384 bytes), not against the destination buffer size. A malicious USB device can therefore set Size to any value up to 16377, causing a heap overflow of up to 16367 bytes when plugged into a host running this driver. valid_csum() is called after read_rom() and also iterates buffer[0..Size-1], compounding the out-of-bounds access. Fix by rejecting descriptors with unexpected length before calling read_rom(). [ johan: amend commit message; also check for short descriptors ]

Özet bilgiler

Ürün: Linux Linux Kernel
CVSS v3.1: 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-787
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
linux-linux-kernel	2.6.12.1	—	5.10.259
linux-linux-kernel	5.11	—	5.15.210
linux-linux-kernel	5.16	—	6.1.176
linux-linux-kernel	6.2	—	6.6.143
linux-linux-kernel	6.7	—	6.12.94
linux-linux-kernel	6.13	—	6.18.36
linux-linux-kernel	6.19	—	7.0.13
linux-linux-kernel	2.6.12	2.6.12	—
linux-linux-kernel	2.6.12	2.6.12	—
linux-linux-kernel	2.6.12	2.6.12	—
linux-linux-kernel	2.6.12	2.6.12	—
linux-linux-kernel	2.6.12	2.6.12	—
linux-linux-kernel	7.1	7.1	—
linux-linux-kernel	7.1	7.1	—
linux-linux-kernel	7.1	7.1	—
linux-linux-kernel	7.1	7.1	—
linux-linux-kernel	7.1	7.1	—
linux-linux-kernel	7.1	7.1	—
linux-linux-kernel	7.1	7.1	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları