CVE-2026-53196 Overview
CVE-2026-53196 is a heap overflow vulnerability in the Linux kernel's USB serial io_ti driver. The flaw resides in the get_manuf_info() function, which reads attacker-controlled length data from a USB device's I2C EEPROM into a fixed-size 10-byte kernel heap buffer. A malicious USB device can supply a Size field of up to 16,377 bytes, causing an out-of-bounds write of as much as 16,367 bytes into kernel heap memory. The issue affects systems that load the io_ti driver when an attacker can attach a crafted USB device. The vulnerability has been resolved upstream by rejecting descriptors with unexpected lengths before read_rom() is called.
Critical Impact
A physically present attacker with a malicious USB device can trigger a kernel heap overflow of up to 16,367 bytes, enabling potential kernel memory corruption, denial of service, or local privilege escalation.
Affected Products
- Linux kernel drivers/usb/serial/io_ti.c USB serial driver
- Multiple stable Linux kernel branches referenced by patch commits 183c1076, 561edb02, b849f30d, cfd634f6, d214d234, d92f17af, e168db91, and f96cf7bf
- Distributions shipping kernels that include the unpatched io_ti driver
Discovery Timeline
- 2026-06-25 - CVE-2026-53196 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-53196
Vulnerability Analysis
The vulnerability is a kernel heap buffer overflow [CWE-122] in the Edgeport USB serial driver io_ti. The function get_manuf_info() allocates a buffer using kmalloc_obj() sized as sizeof(struct edge_ti_manuf_descriptor), which is exactly 10 bytes. It then calls read_rom() to copy le16_to_cpu(rom_desc->Size) bytes from the device's I2C EEPROM into that buffer.
The Size field originates from the USB device and is fully attacker-controlled. The only existing validation occurs in check_i2c_image(), which verifies that the descriptor fits within TI_MAX_I2C_SIZE (16,384 bytes). It never compares Size against the actual destination buffer length. As a result, any value up to 16,377 passes validation and causes a linear heap overflow of up to 16,367 bytes.
The damage is compounded by valid_csum(), which is invoked after read_rom() and iterates over buffer[0..Size-1], producing an additional out-of-bounds read across the same range.
Root Cause
The root cause is missing length validation between an attacker-controlled descriptor field and a fixed-size kernel allocation. The code trusted the device-supplied Size value to match sizeof(struct edge_ti_manuf_descriptor) and never enforced that constraint before the copy operation.
Attack Vector
Exploitation requires physical access or supply-chain control of a USB device. An attacker constructs a USB device that enumerates as an Edgeport TI product handled by io_ti and returns a manufacturing descriptor with an inflated Size value. When a victim connects the device, the kernel driver loads, allocates the 10-byte buffer, and copies the over-sized EEPROM contents into it, corrupting adjacent slab objects.
No synthetic exploitation code is provided. See the upstream fix in Kernel Git Commit 183c1076 for the validation logic added before read_rom().
Detection Methods for CVE-2026-53196
Indicators of Compromise
- Kernel log messages from the io_ti driver referencing failed descriptor reads, checksum mismatches, or kmalloc slab corruption warnings such as BUG: KASAN: slab-out-of-bounds in get_manuf_info.
- Unexpected kernel oops or panic shortly after a USB device is connected to a host loading io_ti.
- USB enumeration events showing Edgeport TI vendor or product IDs from devices not on the asset inventory.
Detection Strategies
- Enable Kernel Address Sanitizer (KASAN) on test kernels to catch out-of-bounds writes in get_manuf_info() and valid_csum() during USB device testing.
- Audit kernel build configuration for the CONFIG_USB_SERIAL_EDGEPORT_TI option and identify hosts where the driver is reachable.
- Correlate udev and dmesg events to flag USB serial devices that fail descriptor validation immediately after connection.
Monitoring Recommendations
- Collect dmesg and journalctl -k output centrally and alert on io_ti, edgeport, or slab corruption strings.
- Monitor USB connection events via auditd rules on /dev/ttyUSB* and the usb subsystem to detect anomalous device attachments.
- Track kernel version inventory to confirm patched builds are deployed across all Linux endpoints and servers.
How to Mitigate CVE-2026-53196
Immediate Actions Required
- Apply the stable kernel updates containing the upstream fix commits referenced in the NVD entry and reboot affected hosts.
- Where patching is delayed, blacklist the io_ti kernel module on systems that do not require Edgeport TI USB serial adapters.
- Restrict physical access to USB ports on servers, kiosks, and shared workstations using chassis controls and port locks.
Patch Information
The vulnerability is resolved upstream by validating the descriptor length before calling read_rom() and rejecting both oversized and short descriptors. Apply one of the upstream fixes: Kernel Git Commit 183c1076, Kernel Git Commit 561edb02, Kernel Git Commit b849f30d, Kernel Git Commit cfd634f6, Kernel Git Commit d214d234, Kernel Git Commit d92f17af, Kernel Git Commit e168db91, or Kernel Git Commit f96cf7bf, then consume the corresponding distribution kernel update.
Workarounds
- Blacklist the io_ti module on hosts that do not need Edgeport TI USB serial support to remove the vulnerable code path.
- Enforce USB device control policies such as usbguard to allow only approved vendor and product IDs to bind to kernel drivers.
- Disable unused USB ports in firmware or via hardware blockers on systems located in untrusted environments.
# Configuration example: blacklist the vulnerable io_ti module
echo 'blacklist io_ti' | sudo tee /etc/modprobe.d/blacklist-io_ti.conf
sudo rmmod io_ti 2>/dev/null || true
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
