CVE-2026-53194: Linux kl5kusb105 USB Serial Driver Buffer Overflow Vulnerability

Technical summary

The klsi_105_prepare_write_buffer() function in the kl5kusb105 driver prepares bulk-out transfers by writing a KLSI_HDR_LEN (2-byte) header followed by payload data from the write fifo. However, the function requests kfifo_out_locked() to copy 'size' bytes (the full bulk-out buffer size, typically 64 bytes) without reducing this count by KLSI_HDR_LEN. This causes kfifo to write 64 bytes starting at buf + 2, exceeding the 64-byte allocation by 2 bytes. The vulnerability is triggered when the write fifo contains at least 64 bytes of data waiting to be transmitted. KASAN telemetry shows writes occurring 2 bytes past the allocated slab region.

Business impact

Systems relying on KL5 USB serial adapters for legacy hardware communication or point-of-sale devices are at risk. A malicious or compromised local user process can trigger a kernel memory corruption that leads to system crashes (denial of service) or, in some configurations, kernel code execution. This is particularly concerning in shared or multi-tenant Linux environments, embedded systems, or industrial control systems using USB serial bridges. Unplanned downtime and potential loss of device control pose operational and safety risks.

Affected systems

All Linux kernel versions containing the vulnerable kl5kusb105 USB serial driver are affected. This includes both desktop and embedded Linux distributions (Red Hat, Ubuntu, Debian, Alpine, and others) that compile this driver or enable USB serial support. Systems must have a KL5 USB device connected or the driver loaded for the vulnerability to be exploitable. Server environments without USB serial hardware and with the driver explicitly disabled are unaffected.

Exploitability

Exploitation requires local access to the system and the ability to write to a tty interface connected to a KL5 USB device. The attack does not require root privileges; any local user with write access to the device node can trigger the overflow by writing sufficient data (64 bytes or more) to the device. The vulnerability is highly reliable and can be triggered through standard write syscalls. No user interaction, network access, or authentication bypass is necessary. This makes it a practical privilege escalation or denial-of-service vector in multi-user systems.

Remediation

The fix modifies klsi_105_prepare_write_buffer() to request at most size - KLSI_HDR_LEN bytes from the fifo, ensuring the header and payload fit within the allocated buffer. This matches the safe pattern already implemented in similar drivers. Linux kernel patch versions addressing this vulnerability should be identified from official vendor advisories and applied immediately to affected systems.

Patch guidance

Check your Linux distribution's security advisory for the specific kernel version addressing CVE-2026-53194. Kernel updates are typically deployed via your package manager (apt, yum, dnf, etc.). After patching, verify the kl5kusb105 driver is reloaded or the system is rebooted to ensure the fix takes effect. Systems without KL5 USB devices should verify whether the driver is necessary; if not, it can be blacklisted to reduce attack surface.

Detection guidance

Monitor system logs and kernel messages for KASAN warnings or out-of-bounds write reports mentioning kl5kusb105 or klsi_105_prepare_write_buffer. Observe for unexpected kernel panics or system hangs coinciding with USB device activity. Use sysfs to list connected USB devices (/sys/bus/usb/devices/) to identify KL5 adapters on your systems. Network-based detection is not applicable; focus on host-level kernel logging and USB device enumeration audits.

Why prioritize this

This is a local privilege escalation and denial-of-service vulnerability with a CVSS score of 7.8 (HIGH). While it requires local access, the low barrier to exploitation—simple write syscalls from any local user—makes it attractive for privilege escalation in multi-user environments. It is not yet listed in the CISA Known Exploited Vulnerabilities catalog, but the straightforward nature of the flaw suggests active researcher interest. Organizations running legacy USB serial bridges or industrial systems should prioritize patching to prevent operational disruption and lateral privilege escalation.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects: (1) Low attack complexity—the overflow is trivial to trigger via standard write syscalls; (2) Local attack vector requiring user-level privilege; (3) High impact on confidentiality, integrity, and availability via kernel memory corruption. The score does not account for the likely prevalence of affected kernel versions in production systems or the relatively low installation base of KL5 devices, which may lower practical risk in some environments but do not diminish the severity of the flaw itself.

Frequently asked questions