CVE-2026-64334: Linux Kernel USB Serial DoS Vulnerability

CVE-2026-64334 Overview

CVE-2026-64334 is a Linux kernel vulnerability in the digi_acceleport USB serial driver. The flaw causes a hard lockup when the driver persistently fails to submit an out-of-band (OOB) write URB. When a USB device is physically disconnected during an open(), set_termios(), or close() operation, the driver enters an indefinite loop with interrupts disabled. The issue was flagged during an unrelated code review by a contributor identified as Sashiko in the upstream commit message. The bug produces a system-level denial of service condition on affected kernels when the specific USB serial hardware is present.

Critical Impact
A physical USB disconnect racing with driver operations can hang the system with interrupts disabled, producing an unrecoverable hard lockup.

Affected Products

Linux kernel builds shipping the drivers/usb/serial/digi_acceleport.c driver
Distributions consuming stable kernel branches prior to the fixes referenced in the upstream commits
Systems using Digi AccelePort USB serial adapters

Discovery Timeline

2026-07-25 - CVE-2026-64334 published to the National Vulnerability Database
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64334

Vulnerability Analysis

The digi_acceleport USB serial driver issues OOB commands during common tty lifecycle operations, including open(), set_termios(), and close(). To transmit these commands, the driver submits a URB (USB Request Block) to the OOB write endpoint. The pre-patch code path did not check the return value of the URB submission call. If submission repeatedly failed, for example because the device was being physically removed, the driver retried in a tight loop while holding interrupts disabled. The retry loop never terminated because the underlying failure condition, device disconnect, was persistent. This produces a hard lockup detected by the kernel's watchdog and renders the CPU unable to service any further work.

Root Cause

The root cause is missing error handling around URB submission in the OOB command path. The driver assumed submission would eventually succeed and did not treat persistent failure as a terminal condition. This is a driver-level logic flaw rather than a memory safety issue.

Attack Vector

Triggering the condition requires physical access to disconnect the USB device at the moment a tty lifecycle operation is in flight. The vulnerability is not remotely exploitable and requires the specific Digi AccelePort hardware to be attached. The consequence is a denial of service on the affected host through a kernel hard lockup.

No verified public exploit code is available. Technical details are contained in the upstream fix commits referenced below.

Detection Methods for CVE-2026-64334

Indicators of Compromise

Kernel log entries reporting NMI watchdog: Watchdog detected hard LOCKUP on cpu correlated with USB disconnect events
Kernel stack traces referencing digi_write_oob_command, digi_open, digi_close, or digi_set_termios at the time of hang
usb 1-x: USB disconnect messages immediately preceding the lockup

Detection Strategies

Inventory hosts running kernels that include drivers/usb/serial/digi_acceleport.c and correlate with kernel package versions predating the upstream fixes
Monitor dmesg and journal output for repeated URB submission failure warnings tied to the digi driver
Use configuration management to enumerate systems where the digi_acceleport module is loaded (lsmod | grep digi)

Monitoring Recommendations

Ship kernel logs to a central store and alert on hard lockup watchdog events tied to USB subsystem stack frames
Track kernel version drift across the fleet to identify hosts still on unpatched stable branches
Alert on unexpected loading of the digi_acceleport module on systems that should not attach that hardware

How to Mitigate CVE-2026-64334

Immediate Actions Required

Upgrade to a Linux kernel release that includes the upstream fix commits listed in the references
On systems that do not require Digi AccelePort adapters, blacklist the digi_acceleport module to eliminate exposure
Restrict physical access to hosts equipped with USB serial adapters to reduce the chance of triggering the disconnect race

Patch Information

The fix adds error checking to URB submission in the OOB command path so that persistent failure exits the loop instead of spinning with interrupts disabled. The change is distributed across multiple stable branches. Reference commits include Kernel Git Commit 2067b38, Kernel Git Commit 2b7dc48, Kernel Git Commit 5a82d84, Kernel Git Commit 5c1ea24, Kernel Git Commit 6a8592a, Kernel Git Commit 6e51147, Kernel Git Commit 79bc131, and Kernel Git Commit bcfeae43.

Workarounds

Blacklist the digi_acceleport module on hosts that do not need it by adding blacklist digi_acceleport to a file under /etc/modprobe.d/
Physically remove Digi AccelePort adapters from systems where they are not required
Avoid hot-unplugging Digi AccelePort devices while userspace processes are opening, closing, or reconfiguring the associated tty

bash

# Configuration example
echo 'blacklist digi_acceleport' | sudo tee /etc/modprobe.d/blacklist-digi_acceleport.conf
sudo rmmod digi_acceleport 2>/dev/null || true
sudo update-initramfs -u