CVE-2026-64335: Linux Kernel USB Serial DoS Vulnerability

CVE-2026-64335 Overview

CVE-2026-64335 is a Linux kernel vulnerability in the digi_acceleport USB serial driver. The flaw causes broken receive (RX) functionality after a throttle event. If a port is closed while throttled, the read URB (USB Request Block) is never resubmitted, leaving the port unable to receive further data until the device is reconnected or the driver is rebound.

The issue affects USB serial communication reliability rather than confidentiality or integrity. Upstream maintainers resolved the defect by clearing the throttle flags and submitting the URB when needed during port open.

Critical Impact
Loss of USB serial data reception on affected digi_acceleport devices, requiring physical reconnection or driver rebind to restore functionality.

Affected Products

Linux kernel drivers/usb/serial/digi_acceleport.c USB serial driver
Systems using Digi AccelePort USB serial adapters
Multiple stable kernel branches (see referenced upstream commits)

Discovery Timeline

2026-07-25 - CVE-2026-64335 published to the National Vulnerability Database (NVD)
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64335

Vulnerability Analysis

The vulnerability resides in the digi_acceleport USB serial driver. When a TTY layer throttles a port to signal that it cannot accept more incoming data, the driver stops resubmitting its read URB. Under normal conditions, unthrottling the port causes the driver to resubmit the read URB and resume data reception.

However, if userspace closes the port while it is still in the throttled state, the driver never re-arms the read URB. On subsequent opens, the throttle flag remains set from the previous session. This state persistence blocks any further RX traffic on that port until the USB device is physically reconnected or the kernel module is rebound.

The defect impacts availability of USB serial communication. It does not enable privilege escalation, information disclosure, or code execution. Consult the upstream kernel commits for the exact diff and the ordering of state clearing during open.

Root Cause

The root cause is incomplete state reset during port open. The digi_acceleport open path did not clear stale throttle flags nor resubmit the read URB when a port was reopened after being closed while throttled. This is a state-management bug in a kernel driver rather than a memory-safety flaw.

Attack Vector

This vulnerability is not remotely exploitable and does not grant attacker-controlled capabilities. Triggering the condition requires local userspace to close a digi_acceleport TTY while it is throttled. The consequence is a functional denial of the serial port, resolved only by device reconnection or driver rebind.

No exploitation code has been published, and the CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. See the upstream Linux kernel commits linked in the references for the authoritative code fix.

Detection Methods for CVE-2026-64335

Indicators of Compromise

No known malicious indicators. This is a functional kernel bug, not a targeted exploit.
Symptomatic indicator: a digi_acceleport TTY that stops delivering RX data after being closed and reopened.
Symptomatic indicator: RX resumes only after USB device reconnection or modprobe -r / rebind of the digi_acceleport driver.

Detection Strategies

Inventory Linux hosts running kernel versions prior to the fix commits (4f3f6f44, 61954033, 83a3dfc0, 8d50a910, 92fa3e1a, abacd67e, d5d2660c, eab39478) and correlate with the presence of Digi AccelePort USB hardware.
Query package management state (uname -r, distribution kernel package version) to identify systems missing the stable backport.
Monitor kernel logs (dmesg, journalctl -k) for repeated digi_acceleport device rebinds or user reports of stalled serial input.

Monitoring Recommendations

Track kernel version drift across Linux fleets to confirm timely uptake of stable kernel updates that include the fix.
Alert on unexpected usb-serial driver unbind/rebind events on production hosts, which can indicate operators working around the bug.
Collect TTY-layer error counters and USB URB submission failures via existing telemetry pipelines for post-incident review.

How to Mitigate CVE-2026-64335

Immediate Actions Required

Update to a Linux kernel build that includes one of the upstream fix commits listed in the references.
On distributions that ship long-term support kernels, apply the vendor stable update containing the digi_acceleport throttle fix.
For hosts that cannot be patched immediately, avoid closing digi_acceleport TTYs while throttled; unthrottle before close where the application permits.

Patch Information

The fix clears the throttle flags and submits the read URB during port open. It is present in the following upstream Linux kernel commits: Linux Kernel Commit 4f3f6f44, Linux Kernel Commit 61954033, Linux Kernel Commit 83a3dfc0, Linux Kernel Commit 8d50a910, Linux Kernel Commit 92fa3e1a, Linux Kernel Commit abacd67e, Linux Kernel Commit d5d2660c, and Linux Kernel Commit eab39478.

Workarounds

Rebind the driver to recover a stalled port: echo <bus-id> > /sys/bus/usb/drivers/digi_acceleport/unbind followed by a matching bind write.
Physically disconnect and reconnect the affected Digi AccelePort USB adapter to reinitialize the read URB.
If digi_acceleport hardware is not required, blocklist the module to eliminate exposure until the kernel is patched.

bash

# Recover a stalled digi_acceleport port by rebinding the driver
DEV_ID=$(ls /sys/bus/usb/drivers/digi_acceleport/ | grep -E '^[0-9]+-')
echo "$DEV_ID" | sudo tee /sys/bus/usb/drivers/digi_acceleport/unbind
echo "$DEV_ID" | sudo tee /sys/bus/usb/drivers/digi_acceleport/bind