CVE-2026-68365: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-68365 Overview

CVE-2026-68365 is a Linux kernel vulnerability in the USB serial io_edgeport driver. The flaw exists in how the driver handles transmit credits reported by USB Edgeport devices through interrupt-status packets. The edge_interrupt_callback() function adds the 16-bit credit value to txCredits without validating against maxTxCredits. Because edge_write() uses txCredits minus the software FIFO count to calculate available space, an inflated credit value can cause an out-of-bounds write [CWE-787] into the ring buffer. The fix caps accumulated credits at maxTxCredits, a limit that conforming devices never reach.

Critical Impact
A malicious or malfunctioning USB Edgeport device can trigger an out-of-bounds write in kernel memory, leading to kernel memory corruption and potential denial of service or privilege escalation.

Affected Products

Linux kernel builds including the USB serial io_edgeport driver
Systems supporting Digi Edgeport USB-to-serial converters
Distributions shipping vulnerable kernel versions prior to the referenced stable commits

Discovery Timeline

2026-08-10 - CVE-2026-68365 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68365

Vulnerability Analysis

The io_edgeport driver manages Digi Edgeport USB-to-serial converter devices. These devices report transmit credits back to the host through interrupt-status packets, signaling how much data the host may send. The driver tracks this budget in a txCredits counter, bounded logically by maxTxCredits, which also sizes the software FIFO ring buffer.

The vulnerability stems from missing bounds enforcement in edge_interrupt_callback(). The callback accumulates the 16-bit credit value directly into txCredits without comparing against maxTxCredits. A device sending inflated credit values causes txCredits to exceed the FIFO's actual capacity.

When edge_write() later computes the available space as txCredits minus the software FIFO count, it can conclude that more room exists than the ring buffer holds. The subsequent write proceeds beyond the allocated buffer, corrupting adjacent kernel memory.

Root Cause

The root cause is missing input validation on device-supplied data. The driver trusts the transmit-credit field from an untrusted USB peripheral without capping the accumulated total. This violates the principle that kernel drivers must sanitize all data crossing the USB trust boundary.

Attack Vector

Exploitation requires a USB Edgeport device or an emulated USB device that reports crafted interrupt-status packets. An attacker with physical access, or one able to attach a rogue USB gadget, can send oversized credit values to drive txCredits past maxTxCredits. Subsequent writes then overflow the ring buffer, corrupting adjacent kernel heap memory.

See the upstream fix in Kernel Git Commit 1e47d82 for the exact patch context. No verified public exploit code is available for this vulnerability at the time of publication.

Detection Methods for CVE-2026-68365

Indicators of Compromise

Unexpected kernel oops, panic, or KASAN out-of-bounds write reports referencing edge_write or io_edgeport
Kernel log entries showing unusual transmit credit accumulation on ttyUSB devices bound to the Edgeport driver
Attachment of unknown or unauthorized USB devices reporting the Digi Edgeport vendor and product identifiers

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface out-of-bounds writes in the io_edgeport ring buffer during fuzzing or QA
Monitor dmesg for stack traces implicating edge_interrupt_callback or edge_write following USB device attach events
Correlate USB device enumeration events with subsequent kernel instability on hosts that use serial converters

Monitoring Recommendations

Audit hosts running the io_edgeport driver by inspecting loaded modules with lsmod | grep io_edgeport
Log USB attach and detach events through udev or auditd rules covering the usb subsystem
Track kernel version inventory against the fixed commits listed in the upstream stable tree

How to Mitigate CVE-2026-68365

Immediate Actions Required

Apply kernel updates that include the fix from the referenced stable commits on all affected systems
Restrict physical and logical access to USB ports on systems that use Edgeport converters
Unload the io_edgeport module with modprobe -r io_edgeport on hosts that do not require Edgeport hardware

Patch Information

The fix caps accumulated credits at maxTxCredits inside edge_interrupt_callback(). Backports are available in multiple stable branches. Reference commits: 1e47d82, 64b687f, cbe0004, ee57992, and faaddd8.

Workarounds

Blacklist the io_edgeport module on systems that do not use Digi Edgeport hardware
Enforce USB device allow-listing through USBGuard or equivalent controls to block unknown peripherals
Restrict serial converter usage to trusted, physically secured hosts until patches are deployed

bash

# Blacklist the vulnerable driver until a patched kernel is deployed
echo "blacklist io_edgeport" | sudo tee /etc/modprobe.d/blacklist-io_edgeport.conf
sudo modprobe -r io_edgeport
sudo update-initramfs -u