Heap-based buffer overflow in Linux kernel - CVE-2026-53196

Vulnerability identifier: #VU135582

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-53196

CWE-ID: CWE-122

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows an attacker with physical access to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in get_manuf_info() in the io_ti USB serial driver when processing a crafted USB device EEPROM descriptor. An attacker with physical access can connect a malicious USB device with a forged Size field to trigger the overflow and cause a denial of service or execute arbitrary code.

The out-of-bounds access is compounded because a checksum routine also iterates over the device-controlled length after the EEPROM data is read.

Linux kernel
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise High Availability Extension 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Workstation Extension 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Live Patching
Basesystem Module
Development Tools Module
Legacy Module
Public Cloud Module
SUSE Real Time Module
openSUSE Leap
kernel-livepatch-SLE15-SP6_Update_29-debugsource
kernel-livepatch-6_4_0-150600_23_125-default
kernel-livepatch-6_4_0-150600_23_125-default-debuginfo
kernel-livepatch-6_4_0-150700_7_67-rt
kernel-livepatch-SLE15-SP7-RT_Update_18-debugsource
kernel-livepatch-6_4_0-150700_7_67-rt-debuginfo
kernel-livepatch-6_4_0-150700_53_73-default-debuginfo
kernel-livepatch-SLE15-SP7_Update_19-debugsource
kernel-livepatch-6_4_0-150700_53_73-default
kernel-default-debuginfo
cluster-md-kmp-default
dlm-kmp-default-debuginfo
kernel-default-optional
kernel-syms
kselftests-kmp-default-debuginfo
ocfs2-kmp-default-debuginfo
cluster-md-kmp-default-debuginfo
kernel-obs-build
kernel-default-debugsource
kernel-obs-build-debugsource
reiserfs-kmp-default
dlm-kmp-default
gfs2-kmp-64kb
kernel-default-devel
dtb-freescale
kselftests-kmp-default
kernel-default-optional-debuginfo
kernel-default-extra-debuginfo
kernel-debug-debuginfo
dtb-rockchip
dlm-kmp-64kb-debuginfo
kernel-default-livepatch
dtb-socionext
kernel-source-vanilla
kernel-debug-devel
kernel-debug-devel-debuginfo
kernel-debug-debugsource
kernel-default
kernel-kvmsmall
kernel-default-livepatch-devel
kernel-zfcpdump
kernel-source
kernel-docs-html
kernel-devel
kernel-macros
ocfs2-kmp-default
kernel-kvmsmall-debugsource
kernel-kvmsmall-debuginfo
kernel-kvmsmall-devel
kernel-kvmsmall-devel-debuginfo
gfs2-kmp-default
kernel-default-extra
kernel-obs-qa
gfs2-kmp-default-debuginfo
kernel-default-devel-debuginfo
reiserfs-kmp-default-debuginfo
dtb-aarch64
kernel-64kb-extra-debuginfo
dtb-sprd
kernel-64kb-debuginfo
dtb-amd
dtb-amlogic
cluster-md-kmp-64kb-debuginfo
dtb-amazon
dlm-kmp-64kb
kselftests-kmp-64kb-debuginfo
kernel-64kb-optional-debuginfo
dtb-lg
dtb-apm
dtb-cavium
kernel-docs
kernel-64kb
kernel-debug
kernel-zfcpdump-debuginfo
kernel-zfcpdump-debugsource
kernel-debug-vdso-debuginfo
kernel-kvmsmall-vdso
kernel-kvmsmall-vdso-debuginfo
kernel-default-vdso
kernel-debug-vdso
kernel-default-vdso-debuginfo
dtb-xilinx
reiserfs-kmp-64kb
kernel-64kb-devel
dtb-marvell
dtb-apple
dtb-exynos
dtb-allwinner
gfs2-kmp-64kb-debuginfo
dtb-hisilicon
cluster-md-kmp-64kb
dtb-qcom
kernel-64kb-optional
kselftests-kmp-64kb
dtb-altera
dtb-broadcom
kernel-64kb-devel-debuginfo
dtb-arm
dtb-renesas
kernel-64kb-debugsource
ocfs2-kmp-64kb-debuginfo
reiserfs-kmp-64kb-debuginfo
ocfs2-kmp-64kb
kernel-64kb-extra
dtb-mediatek
dtb-nvidia
kernel-default-base-rebuild
kernel-default-base
ocfs2-kmp-rt
cluster-md-kmp-rt-debuginfo
kernel-rt-devel-debuginfo
gfs2-kmp-rt
dlm-kmp-rt-debuginfo
kernel-rt
kernel-rt-devel
gfs2-kmp-rt-debuginfo
kernel-syms-rt
ocfs2-kmp-rt-debuginfo
kernel-rt-debugsource
cluster-md-kmp-rt
dlm-kmp-rt
kernel-rt-debuginfo
kernel-devel-rt
kernel-source-rt
kernel-azure
kernel-azure-debugsource
kernel-azure-debuginfo
kernel-azure-devel-debuginfo
kernel-azure-devel

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel-livepatch-SLE15-SP6_Update_29-debugsource - update to 1-150600.13.7.1
kernel-livepatch-6_4_0-150600_23_125-default - update to 1-150600.13.7.1
kernel-livepatch-6_4_0-150600_23_125-default-debuginfo - update to 1-150600.13.7.1
kernel-livepatch-6_4_0-150700_7_67-rt - update to 1-150700.1.5.1
kernel-livepatch-SLE15-SP7-RT_Update_18-debugsource - update to 1-150700.1.5.1
kernel-livepatch-6_4_0-150700_7_67-rt-debuginfo - update to 1-150700.1.5.1
kernel-livepatch-6_4_0-150700_53_73-default-debuginfo - update to 1-150700.15.3.4
kernel-livepatch-SLE15-SP7_Update_19-debugsource - update to 1-150700.15.3.4
kernel-livepatch-6_4_0-150700_53_73-default - update to 1-150700.15.3.4
kernel-default-debuginfo - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
cluster-md-kmp-default - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
dlm-kmp-default-debuginfo - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-default-optional - update to 6.4.0-150600.23.125.1
kernel-syms - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.1
kselftests-kmp-default-debuginfo - update to 6.4.0-150600.23.125.1
ocfs2-kmp-default-debuginfo - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
cluster-md-kmp-default-debuginfo - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-obs-build - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-default-debugsource - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-obs-build-debugsource - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
reiserfs-kmp-default - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
dlm-kmp-default - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
gfs2-kmp-64kb - update to 6.4.0-150600.23.125.1
kernel-default-devel - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
dtb-freescale - update to 6.4.0-150600.23.125.1
kselftests-kmp-default - update to 6.4.0-150600.23.125.1
kernel-default-optional-debuginfo - update to 6.4.0-150600.23.125.1
kernel-default-extra-debuginfo - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-debug-debuginfo - update to 6.4.0-150600.23.125.1
dtb-rockchip - update to 6.4.0-150600.23.125.1
dlm-kmp-64kb-debuginfo - update to 6.4.0-150600.23.125.1
kernel-default-livepatch - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
dtb-socionext - update to 6.4.0-150600.23.125.1
kernel-source-vanilla - update to 6.4.0-150600.23.125.1
kernel-debug-devel - update to 6.4.0-150600.23.125.1
kernel-debug-devel-debuginfo - update to 6.4.0-150600.23.125.1
kernel-debug-debugsource - update to 6.4.0-150600.23.125.1
kernel-default - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-kvmsmall - update to 6.4.0-150600.23.125.1
kernel-default-livepatch-devel - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-zfcpdump - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-source - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.1
kernel-docs-html - update to 6.4.0-150600.23.125.1
kernel-devel - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.1
kernel-macros - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.1
ocfs2-kmp-default - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-kvmsmall-debugsource - update to 6.4.0-150600.23.125.1
kernel-kvmsmall-debuginfo - update to 6.4.0-150600.23.125.1
kernel-kvmsmall-devel - update to 6.4.0-150600.23.125.1
kernel-kvmsmall-devel-debuginfo - update to 6.4.0-150600.23.125.1
gfs2-kmp-default - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-default-extra - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-obs-qa - update to 6.4.0-150600.23.125.1
gfs2-kmp-default-debuginfo - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-default-devel-debuginfo - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
reiserfs-kmp-default-debuginfo - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
dtb-aarch64 - update to 6.4.0-150600.23.125.1
kernel-64kb-extra-debuginfo - update to 6.4.0-150600.23.125.1
dtb-sprd - update to 6.4.0-150600.23.125.1
kernel-64kb-debuginfo - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
dtb-amd - update to 6.4.0-150600.23.125.1
dtb-amlogic - update to 6.4.0-150600.23.125.1
cluster-md-kmp-64kb-debuginfo - update to 6.4.0-150600.23.125.1
dtb-amazon - update to 6.4.0-150600.23.125.1
dlm-kmp-64kb - update to 6.4.0-150600.23.125.1
kselftests-kmp-64kb-debuginfo - update to 6.4.0-150600.23.125.1
kernel-64kb-optional-debuginfo - update to 6.4.0-150600.23.125.1
dtb-lg - update to 6.4.0-150600.23.125.1
dtb-apm - update to 6.4.0-150600.23.125.1
dtb-cavium - update to 6.4.0-150600.23.125.1
kernel-docs - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.1
kernel-64kb - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-debug - update to 6.4.0-150600.23.125.1
kernel-zfcpdump-debuginfo - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-zfcpdump-debugsource - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
kernel-debug-vdso-debuginfo - update to 6.4.0-150600.23.125.1
kernel-kvmsmall-vdso - update to 6.4.0-150600.23.125.1
kernel-kvmsmall-vdso-debuginfo - update to 6.4.0-150600.23.125.1
kernel-default-vdso - update to 6.4.0-150600.23.125.1
kernel-debug-vdso - update to 6.4.0-150600.23.125.1
kernel-default-vdso-debuginfo - update to 6.4.0-150600.23.125.1
dtb-xilinx - update to 6.4.0-150600.23.125.1
reiserfs-kmp-64kb - update to 6.4.0-150600.23.125.1
kernel-64kb-devel - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
dtb-marvell - update to 6.4.0-150600.23.125.1
dtb-apple - update to 6.4.0-150600.23.125.1
dtb-exynos - update to 6.4.0-150600.23.125.1
dtb-allwinner - update to 6.4.0-150600.23.125.1
gfs2-kmp-64kb-debuginfo - update to 6.4.0-150600.23.125.1
dtb-hisilicon - update to 6.4.0-150600.23.125.1
cluster-md-kmp-64kb - update to 6.4.0-150600.23.125.1
dtb-qcom - update to 6.4.0-150600.23.125.1
kernel-64kb-optional - update to 6.4.0-150600.23.125.1
kselftests-kmp-64kb - update to 6.4.0-150600.23.125.1
dtb-altera - update to 6.4.0-150600.23.125.1
dtb-broadcom - update to 6.4.0-150600.23.125.1
kernel-64kb-devel-debuginfo - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
dtb-arm - update to 6.4.0-150600.23.125.1
dtb-renesas - update to 6.4.0-150600.23.125.1
kernel-64kb-debugsource - addressed in versions 6.4.0-150600.23.125.1, 6.4.0-150700.53.73.2
ocfs2-kmp-64kb-debuginfo - update to 6.4.0-150600.23.125.1
reiserfs-kmp-64kb-debuginfo - update to 6.4.0-150600.23.125.1
ocfs2-kmp-64kb - update to 6.4.0-150600.23.125.1
kernel-64kb-extra - update to 6.4.0-150600.23.125.1
dtb-mediatek - update to 6.4.0-150600.23.125.1
dtb-nvidia - update to 6.4.0-150600.23.125.1
kernel-default-base-rebuild - update to 6.4.0-150600.23.125.1.150600.12.58.3
kernel-default-base - addressed in versions 6.4.0-150600.23.125.1.150600.12.58.3, 6.4.0-150700.53.73.2.150700.17.41.4
ocfs2-kmp-rt - update to 6.4.0-150700.7.67.1
cluster-md-kmp-rt-debuginfo - update to 6.4.0-150700.7.67.1
kernel-rt-devel-debuginfo - update to 6.4.0-150700.7.67.1
gfs2-kmp-rt - update to 6.4.0-150700.7.67.1
dlm-kmp-rt-debuginfo - update to 6.4.0-150700.7.67.1
kernel-rt - update to 6.4.0-150700.7.67.1
kernel-rt-devel - update to 6.4.0-150700.7.67.1
gfs2-kmp-rt-debuginfo - update to 6.4.0-150700.7.67.1
kernel-syms-rt - update to 6.4.0-150700.7.67.1
ocfs2-kmp-rt-debuginfo - update to 6.4.0-150700.7.67.1
kernel-rt-debugsource - update to 6.4.0-150700.7.67.1
cluster-md-kmp-rt - update to 6.4.0-150700.7.67.1
dlm-kmp-rt - update to 6.4.0-150700.7.67.1
kernel-rt-debuginfo - update to 6.4.0-150700.7.67.1
kernel-devel-rt - update to 6.4.0-150700.7.67.1
kernel-source-rt - update to 6.4.0-150700.7.67.1
kernel-azure - update to 6.4.0-150700.53.73.2
kernel-azure-debugsource - update to 6.4.0-150700.53.73.2
kernel-azure-debuginfo - update to 6.4.0-150700.53.73.2
kernel-azure-devel-debuginfo - update to 6.4.0-150700.53.73.2
kernel-azure-devel - update to 6.4.0-150700.53.73.2

• https://git.kernel.org/stable/c/183c1076eca43bbb3e7bdf597456f91d81c73e74
• https://git.kernel.org/stable/c/561edb021486e6723d841926aa4b48097da06190
• https://git.kernel.org/stable/c/b849f30d1a9e66aae6b715aaef66e427390cb081
• https://git.kernel.org/stable/c/cfd634f6dfd40c49a84f9bddc2867a80e2e2623a
• https://git.kernel.org/stable/c/d214d2341d4f9f447e36a7d012cdf6a6631a55f1
• https://git.kernel.org/stable/c/d92f17af7097d10bdeddf26f66f34b354104b277
• https://git.kernel.org/stable/c/e168db91442b94e64fa82a7dd297983d48ea5cc0
• https://git.kernel.org/stable/c/f96cf7bf9fbf15d7fcf0c91fec47ba8a010369ea

• Heap-based buffer overflow in Linux kernel usb serial driver
• SUSE update for the Linux Kernel
• SUSE update for the Linux Kernel
• SUSE update for the Linux Kernel