CVE-2026-64336 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: keyspan_pda: fix information leak
The write() callback is supposed to return the number of characters accepted or a negative errno. Since the addition of write fifo support the keyspan_pda implementation will however return the number characters submitted to the device if the write urb is not already in use. If this number is larger than the number of characters passed to write(), the line discipline continues writing data from beyond the tty write buffer.
Fix the information leak by making sure that keyspan_pda_write_start() returns zero on success as intended.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability identified in the Linux kernel represents a critical information disclosure issue within the USB serial driver subsystem, specifically affecting the keyspan_pda module used for USB-to-serial communication with certain devices. This flaw resides in the kernel's handling of write operations through the USB serial interface, where improper return value management creates a pathway for sensitive data exposure. The vulnerability manifests when the keyspan_pda driver processes write requests to USB serial devices, creating an information leak that could potentially expose kernel memory contents to user-space applications.
The technical implementation flaw occurs within the write() callback function of the keyspan_pda driver, which is designed to return either the number of characters successfully accepted by the device or a negative errno value indicating failure. However, due to changes implementing write fifo support, the driver's keyspan_pda_write_start() function began returning the count of characters submitted to the USB device rather than the expected behavior of returning zero on successful operation. This deviation from intended functionality creates a direct information leak when the returned character count exceeds the actual number of characters passed to the write() function during processing.
The operational impact of this vulnerability extends beyond simple data exposure, as it enables potential attackers to read beyond the boundaries of the tty write buffer through the line discipline mechanism. When the write urb is not already in use, the driver returns a character count that may exceed user-supplied data, causing the line discipline layer to continue writing data from kernel memory locations beyond the intended buffer boundaries. This behavior creates a systematic information leak that could expose sensitive kernel memory contents including stack data, device state information, or other confidential data structures.
Security implications of this vulnerability align with CWE-200, which addresses "Information Exposure," and represents a classic case of improper output handling in kernel space. The flaw demonstrates weak input validation and output boundary checking within the USB serial driver implementation, creating opportunities for unauthorized access to kernel memory contents that should remain protected from user-space access. This vulnerability specifically impacts systems running Linux kernels with USB serial support where keyspan_pda drivers are active, potentially affecting embedded devices, industrial control systems, or any platform utilizing USB-to-serial communication with affected hardware.
The mitigation strategy requires correcting the return value behavior in the keyspan_pda_write_start() function to ensure it properly returns zero on successful operation as originally intended. This fix ensures that the line discipline layer correctly interprets the driver's response and prevents continuation of writes beyond the original buffer boundaries. System administrators should update their kernel versions to include this patch, particularly those running embedded systems or industrial equipment where USB serial communication is prevalent. Additionally, monitoring for unusual write behavior patterns in USB serial device interactions may help detect exploitation attempts, though the primary defense remains the kernel-level fix addressing the fundamental return value handling issue.