CVE-2026-64336 Overview
CVE-2026-64336 is an information disclosure vulnerability in the Linux kernel's keyspan_pda USB serial driver. The write() callback returns an incorrect character count when the write URB is not already in use. This causes the tty line discipline to read and transmit data from beyond the tty write buffer, leaking uninitialized kernel memory to the connected USB serial device.
Critical Impact
Local attackers with access to a Keyspan PDA USB serial device can trigger the driver to leak adjacent kernel memory contents through the serial write path, potentially exposing sensitive information residing in kernel buffers.
Affected Products
- Linux kernel drivers/usb/serial/keyspan_pda.c USB serial driver
- Systems using Keyspan PDA family USB-to-serial adapters
- Multiple stable Linux kernel branches (see referenced git commits for exact versions)
Discovery Timeline
- 2026-07-25 - CVE-2026-64336 published to NVD
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64336
Vulnerability Analysis
The vulnerability resides in the keyspan_pda USB serial driver, specifically in the keyspan_pda_write_start() helper invoked from the driver's write() callback. The kernel's tty layer expects write() to return the number of characters accepted from the caller's buffer, or a negative errno on failure. Returning a count larger than what was actually consumed causes the line discipline to advance its buffer pointer past valid data.
After the addition of write FIFO support, the driver began returning the count of characters submitted to the device rather than the number of characters accepted from the caller. When the write URB was not already in use, this value could exceed the length passed to write(). The line discipline then continued reading past the end of the tty write buffer, transmitting uninitialized kernel memory over the USB serial link.
Root Cause
The root cause is an incorrect return value contract in keyspan_pda_write_start(). The function returned a submitted-byte count on success instead of returning zero as the calling convention required. The fix ensures the function returns zero on success, restoring the invariant that the write() callback reports only the number of caller-supplied bytes accepted.
Attack Vector
Exploitation requires local access to a system with an attached Keyspan PDA USB serial adapter and permission to open the corresponding tty device. An attacker issues write() system calls against the tty and observes the resulting serial output stream. The leaked bytes originate from memory adjacent to the tty write buffer, which may contain residual kernel data. Because the trigger is a normal write operation, no elevated privileges beyond tty device access are required.
No verified public exploit code is available. See the referenced Kernel Git Commits for the exact patch content across affected stable branches.
Detection Methods for CVE-2026-64336
Indicators of Compromise
- Unexpected data patterns transmitted from /dev/ttyUSB* devices bound to the keyspan_pda driver that do not correspond to application-level writes
- Presence of unpatched keyspan_pda.c on hosts with attached Keyspan PDA USB serial adapters
- Kernel version strings matching pre-patch stable branches referenced in the upstream advisory
Detection Strategies
- Inventory Linux hosts loading the keyspan_pda kernel module using lsmod and cross-reference against patched kernel versions
- Audit tty device access to identify unprivileged processes opening Keyspan PDA serial devices and issuing anomalous write patterns
- Monitor kernel package versions across the fleet and flag systems running kernel builds that predate the fix commits
Monitoring Recommendations
- Enable kernel audit rules for open() and write() syscalls targeting /dev/ttyUSB* device nodes
- Track USB device connection events via udev logs to detect attachment of Keyspan PDA adapters on sensitive hosts
- Aggregate kernel version telemetry in a centralized data store to identify hosts still exposing the vulnerable driver
How to Mitigate CVE-2026-64336
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the vendor advisory to all affected systems
- Unload the keyspan_pda module on hosts that do not require Keyspan PDA USB serial connectivity using rmmod keyspan_pda
- Restrict access to /dev/ttyUSB* device nodes through group permissions and udev rules on multi-user systems
Patch Information
The fix ensures keyspan_pda_write_start() returns zero on success, so the driver's write() callback reports only the number of caller-supplied characters accepted. The corrective commits are available in the upstream stable trees, including commit 2f7a6b8a, commit 6bfc8d01, commit b069b702, commit cf6ca0ae, commit d4b12b6b, commit e1494191, and commit e52ca411. Consume the fix through your distribution's kernel update channel.
Workarounds
- Blacklist the keyspan_pda module on systems that do not require the driver by adding blacklist keyspan_pda to /etc/modprobe.d/
- Physically remove or disable Keyspan PDA USB adapters on hosts that cannot be immediately patched
- Limit tty device access to trusted users only by tightening group membership on the dialout (or equivalent) group
# Blacklist the vulnerable driver until the kernel is patched
echo 'blacklist keyspan_pda' | sudo tee /etc/modprobe.d/blacklist-keyspan_pda.conf
sudo rmmod keyspan_pda 2>/dev/null || true
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
