Out-of-bounds write in Linux kernel - CVE-2026-64333
Published: July 27, 2026
Vulnerability identifier: #VU139639
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64333
CWE-ID: CWE-787
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to memory corruption in digi_write_inb_command() in the digi_acceleport usb serial driver when handling usb serial write commands while the write urb is in use. A local user can trigger a timeout or no-timeout command path to corrupt the write urb buffer to cause memory corruption.
On 32-bit systems, one corruption path is triggered by a broken jiffies comparison after several minutes of system uptime, while commands such as break control can corrupt the urb immediately when no timeout is used.
Affected software
Linux kernel
How to mitigate CVE-2026-64333
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/1243f120790042c2ac92e84e797dacc75fff4366
- https://git.kernel.org/stable/c/24ca1fea8f2753bf33e1d458ec1ae5d9b7796a65
- https://git.kernel.org/stable/c/2f296974acc279f05f284441bfe3064074958d11
- https://git.kernel.org/stable/c/5d9dc88bdf8897788b0eed57113e9eca7fd42ea9
- https://git.kernel.org/stable/c/699dfb6917503b3cda4d5da6941cf79c3c1b4c8b
- https://git.kernel.org/stable/c/a274b3794fe1852c3d9fe6d900b94053c0b03410
- https://git.kernel.org/stable/c/a3a13fdc53103b07335918e2cdeb465038a71725
- https://git.kernel.org/stable/c/e60e4873e9178da9f4f2674e4c2ff085d5a84f79