CVE-2026-53196: Linux io_ti USB Driver Heap Overflow – Physical Access RCE Risk

Technical summary

The io_ti USB serial driver's get_manuf_info() function allocates a 10-byte buffer (struct edge_ti_manuf_descriptor) but reads a byte count directly from device firmware without bounds-checking against the destination buffer. The Size field from the device's I2C EEPROM is validated only to ensure it fits within the global TI_MAX_I2C_SIZE limit (16384 bytes), not the 10-byte allocation. This allows a malicious device to trigger a heap overflow of up to 16367 bytes. The vulnerability is compounded by valid_csum() iterating over the same untrusted boundary post-read. The fix adds explicit validation of descriptor length before reading from the device.

Business impact

This vulnerability requires physical access (USB connection) to a host and affects systems running vulnerable Linux kernel versions with the io_ti serial driver enabled. Exploitation could lead to local privilege escalation, information disclosure, or denial of service. Organizations with industrial control systems, lab equipment, or other USB-connected hardware using this driver face a material risk if threat actors can control or intercept USB devices in their environment.

Affected systems

The Linux kernel io_ti USB serial driver is affected. This driver supports Edgeport USB-to-serial adapters manufactured by Inside Out Networks (now Digi). Any system with this driver compiled in and configured to handle such devices is vulnerable. Desktop and server systems accepting untrusted USB devices are at highest risk.

Exploitability

Exploitation requires physical access to plug in a malicious USB device. The attack surface is limited to environments where users connect unknown or untrusted USB hardware. The device firmware is fully controlled by the attacker, making the heap overflow trivial to trigger. Once triggered, an attacker with local access could potentially escalate privileges or crash the kernel, though the complexity of reliably achieving code execution varies by kernel configuration and ASLR implementation.

Remediation

Apply the kernel security patch that adds bounds validation to reject manufacturer descriptors with unexpected size values before attempting to read data from the device. Verify the patch is available in your Linux distribution's kernel update and deploy it to affected systems. As an interim measure, disable the io_ti driver module if USB Edgeport devices are not required.

Patch guidance

Contact your Linux distribution vendor (Red Hat, Canonical, SUSE, etc.) for a patched kernel version incorporating the io_ti heap overflow fix. The patch adds length validation in the io_ti driver to reject descriptors that do not match the expected struct size. Deployment should be prioritized for systems that accept external USB devices or operate in untrusted physical environments. Verify driver functionality after patching if Edgeport devices are in use.

Detection guidance

Monitor kernel logs for memory corruption warnings, heap allocator errors, or oops messages that correlate with USB device connection events. Systems running commodity Edgeport devices should log their insertion and removal; unexplained heap errors around these times warrant investigation. Tools like AddressSanitizer or KASAN (Kernel Address Sanitizer) in development/test builds will immediately detect the overflow; production systems should rely on kernel crash dumps and audit logs of USB device enumeration.

Why prioritize this

Although exploitation requires physical access (reducing exposed attack surface), the severity of the heap overflow—capable of overwriting arbitrary kernel memory with attacker-controlled data—justifies timely patching. Organizations in high-security environments or those accepting USB devices from less-trusted sources should prioritize this update. The CVSS score of 6.8 reflects the high impact on confidentiality, integrity, and availability, balanced against the physical access requirement.

Risk score, explained

The CVSS 3.1 score of 6.8 (MEDIUM) reflects: Attack Vector:Physical (requiring USB insertion), Access Complexity:Low (no special conditions after insertion), Privileges:None (no auth needed), User Interaction:None (automatic on plug), with high impact on Confidentiality, Integrity, and Availability. The physical requirement prevents remote exploitation but does not diminish the severity of the resulting memory corruption for vulnerable deployments.

Frequently asked questions