CVE-2026-64333: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64333 Overview

CVE-2026-64333 is a Linux kernel vulnerability in the digi_acceleport USB serial driver. The digi_write_inb_command() function fails to return on timeout and instead updates the transfer buffer while attempting to resubmit an active URB. For commands like break control that pass no timeout, a broken jiffies comparison causes the driver to corrupt the URB immediately. On 32-bit systems, the flaw triggers after approximately five minutes of uptime due to INITIAL_JIFFIES. The vulnerability affects local kernel memory integrity and can produce high impact to confidentiality, integrity, and availability of the affected system.

Critical Impact
Local attackers with access to the affected USB serial device can trigger write buffer corruption in kernel memory, leading to denial of service or possible memory integrity compromise.

Affected Products

Linux kernel versions containing the digi_acceleport USB serial driver
Systems using Digi AccelePort USB serial adapters
32-bit Linux systems are particularly susceptible due to the INITIAL_JIFFIES behavior

Discovery Timeline

2026-07-25 - CVE-2026-64333 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64333

Vulnerability Analysis

The vulnerability resides in digi_write_inb_command() within the digi_acceleport USB serial driver. The function must wait for the write URB to become available or return an error on timeout. Instead, on timeout it updates the transfer buffer and attempts to resubmit the URB that is still owned by the USB core. This produces write buffer corruption in kernel memory space.

Commands such as break control invoke the function without specifying a timeout. A broken jiffies comparison causes the wait loop to exit immediately in that path, corrupting the URB without any delay. On 32-bit machines, INITIAL_JIFFIES shifts the jiffies counter so the miscompare only manifests after roughly five minutes of uptime.

Root Cause

The root cause is a missing return statement on timeout combined with an incorrect jiffies comparison. When no timeout is supplied, the function should wait indefinitely for the URB to become available. Instead, the arithmetic in the timeout check evaluates incorrectly, allowing the function to fall through into the buffer update and resubmission logic while the URB is still in flight. This constitutes a kernel driver flaw affecting shared USB transfer buffers.

Attack Vector

Exploitation requires local access with low privileges to interact with the affected USB serial device (for example, through /dev/ttyUSB* nodes). No user interaction is required. A local user issuing break-control operations or other commands lacking a timeout can trigger URB corruption. The upstream fix adds the missing return on timeout and ensures the driver waits indefinitely when no timeout has been specified. Refer to the Linux Kernel Commit 699dfb69 and additional stable-tree backports for technical details.

Detection Methods for CVE-2026-64333

Indicators of Compromise

Unexpected kernel oops or panic messages referencing digi_acceleport or digi_write_inb_command
USB serial device errors, resubmission failures, or transfer buffer corruption warnings in dmesg
Unexplained hangs or crashes on systems using Digi AccelePort USB serial adapters after roughly five minutes of uptime on 32-bit kernels

Detection Strategies

Audit loaded kernel modules for digi_acceleport using lsmod on systems that do not require the driver
Verify running kernel versions against fixed stable-tree commits listed in the Linux kernel advisory references
Correlate USB device enumeration events with subsequent kernel error messages to identify triggering workflows

Monitoring Recommendations

Collect and centralize kernel logs (dmesg, /var/log/kern.log) into a SIEM for pattern matching on driver faults
Monitor local user access to /dev/ttyUSB* device nodes and unusual serial I/O activity
Track kernel package versions across the fleet and flag hosts running unpatched kernels with the vulnerable driver loaded

How to Mitigate CVE-2026-64333

Immediate Actions Required

Apply the upstream Linux kernel patches from your distribution vendor as soon as they become available
Unload the digi_acceleport module on systems that do not require Digi AccelePort USB serial hardware
Restrict local access to USB serial device nodes to trusted users and services only

Patch Information

The fix was committed to the mainline and stable Linux kernel trees. It adds the missing return on timeout and ensures the driver waits indefinitely when no timeout is specified. See the Linux Kernel Commit 1243f120, Linux Kernel Commit 24ca1fea, Linux Kernel Commit 2f296974, Linux Kernel Commit 5d9dc88b, Linux Kernel Commit 699dfb69, Linux Kernel Commit a274b379, Linux Kernel Commit a3a13fdc, and Linux Kernel Commit e60e4873 for the backports across supported stable branches.

Workarounds

Blacklist the digi_acceleport kernel module on systems that do not need it to prevent load at boot
Physically disconnect Digi AccelePort USB serial adapters from production hosts until patches are applied
Enforce strict permissions on /dev/ttyUSB* nodes via udev rules to limit which users can trigger the vulnerable code path

bash

# Blacklist the vulnerable module and prevent automatic load
echo 'blacklist digi_acceleport' | sudo tee /etc/modprobe.d/blacklist-digi_acceleport.conf
sudo rmmod digi_acceleport 2>/dev/null || true
sudo update-initramfs -u