CVE-2026-53194 Overview
CVE-2026-53194 is a slab out-of-bounds write vulnerability in the Linux kernel's kl5kusb105 USB serial driver. The flaw resides in the klsi_105_prepare_write_buffer() function, which incorrectly calculates the size of the payload copied from the write FIFO into the bulk-out buffer. The function reserves two bytes for a length header but still passes the full 64-byte buffer size to kfifo_out_locked(), causing a write past the end of the allocated region. The condition was confirmed using KASAN with dummy_hcd and raw-gadget emulation. The vulnerability has been resolved through multiple stable kernel patches.
Critical Impact
Writing bulk_out_size or more bytes to a tty backed by a kl5kusb105-driven USB-to-serial adapter triggers a kernel slab heap overflow that can lead to memory corruption and potential denial of service.
Affected Products
- Linux kernel — drivers/usb/serial/kl5kusb105.c
- Systems with KLSI KL5KUSB105-based USB-to-serial adapters attached
- Multiple stable kernel branches addressed via the referenced patch commits
Discovery Timeline
- 2026-06-25 - CVE-2026-53194 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-53194
Vulnerability Analysis
The kl5kusb105 driver implements a USB-to-serial protocol that prefixes outbound bulk transfers with a two-byte length header (KLSI_HDR_LEN). The generic USB serial write path allocates a bulk-out buffer of bulk_out_size (64 bytes) and invokes klsi_105_prepare_write_buffer() to populate it.
The function writes the header at the start of the buffer and then copies payload bytes from the per-port write FIFO into buf + KLSI_HDR_LEN. The bug is that the third argument to kfifo_out_locked() is size (the full buffer length) rather than size - KLSI_HDR_LEN. When the FIFO holds at least size bytes, the copy writes KLSI_HDR_LEN bytes beyond the allocation.
KASAN reports the issue as a slab-out-of-bounds write of 64 bytes into a 64-byte region, with the corruption beginning two bytes past the allocation boundary. The faulty call chain is kfifo_copy_out → klsi_105_prepare_write_buffer → usb_serial_generic_write_start.
Root Cause
The root cause is an incorrect length argument supplied to a FIFO copy operation. The driver fails to account for the reserved header bytes when computing the remaining writable space, in contrast to safe_serial, which correctly subtracts the header length. This is an out-of-bounds write classified within the buffer overflow family.
Attack Vector
Triggering the flaw requires a kl5kusb105-bound USB device to be present and a local writer pushing at least bulk_out_size bytes to the associated tty. The reproduction demonstrated in the patch description used dummy_hcd with raw-gadget to emulate the device, meaning a local attacker with the ability to expose a synthetic USB gadget can reach the vulnerable code path. Physical attackers presenting a malicious USB device that matches the driver's vendor and product identifiers also reach the same path.
No public exploit code is available. The vulnerability mechanism is documented in the upstream commit messages referenced below.
Detection Methods for CVE-2026-53194
Indicators of Compromise
- KASAN reports referencing slab-out-of-bounds in kfifo_copy_out with a call trace through klsi_105_prepare_write_buffer
- Kernel oops or panic traces involving the kl5kusb105 module after tty writes to a /dev/ttyUSB* device
- Presence of the kl5kusb105 module loaded on systems where no legitimate KLSI USB serial adapter is in use
Detection Strategies
- Audit loaded kernel modules with lsmod | grep kl5kusb105 and confirm the module is required for the workload
- Review kernel ring buffer output via dmesg for slab corruption signatures and unexpected usbserial warnings
- Compare running kernel version against the fixed commits (0a57320f, 14147b79, 372f33eb, 60af1fd8, 70d86e35, 96d47e40, a1288cd7, bde742b0) referenced in the upstream advisories
Monitoring Recommendations
- Forward kernel logs to a centralized analytics pipeline and alert on KASAN, slab corruption, and tty driver fault patterns
- Monitor USB device enumeration events (udev) for unexpected attachments matching the KLSI vendor and product identifiers
- Track use of raw-gadget and dummy_hcd on production systems, which should not normally be loaded outside test environments
How to Mitigate CVE-2026-53194
Immediate Actions Required
- Apply the upstream stable kernel update that contains one of the fix commits listed in the references
- If patching is not immediately possible, unload the kl5kusb105 module with modprobe -r kl5kusb105 and blacklist it on systems without the hardware
- Restrict physical USB access and disable loading of dummy_hcd and raw-gadget on production hosts
Patch Information
The fix changes the FIFO copy length from size to size - KLSI_HDR_LEN, matching the pattern already used by safe_serial. The corrected call reserves space for the two-byte header and prevents the out-of-bounds write. Backports are available across multiple stable branches; consult the upstream commits Kernel Patch 0a57320f, Kernel Patch 14147b79, Kernel Patch 372f33eb, Kernel Patch 60af1fd8, Kernel Patch 70d86e35, Kernel Patch 96d47e40, Kernel Patch a1288cd7, and Kernel Patch bde742b0 for the branch matching your deployment.
Workarounds
- Blacklist the kl5kusb105 module via /etc/modprobe.d/ on systems that do not require KLSI USB-to-serial adapters
- Disable USB gadget emulation by ensuring dummy_hcd and raw-gadget are not built or loaded on production kernels
- Limit local user access to tty devices and write privileges on /dev/ttyUSB* nodes
# Configuration example - blacklist the vulnerable module
echo 'blacklist kl5kusb105' | sudo tee /etc/modprobe.d/cve-2026-53194.conf
sudo modprobe -r kl5kusb105 2>/dev/null || true
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
