CVE-2026-53194

What it actually does

CVE-2026-53194 is a Linux kernel memory-corruption flaw in the kl5kusb105 USB serial driver. The driver reserves two bytes at the start of a 64-byte bulk-out buffer for a length header, but copies up to the full 64-byte payload starting two bytes into that buffer. When 64 or more bytes are written to the associated TTY, the driver can write two bytes beyond the allocated slab buffer. The immediate technical impact is a kernel slab out-of-bounds write, which can cause kernel memory corruption, system crash, or potentially be used as part of a local kernel exploitation chain depending on allocator state, hardening, device access, and exploit reliability.

Why it matters to the business

Systems that load the affected USB serial driver can be destabilized by a local user, malicious peripheral, test harness, or compromised process with access to the associated serial TTY. The most likely operational impact is denial of service through kernel crash or device/host instability; privilege escalation is not confirmed but should not be ruled out for kernel memory-corruption bugs. The issue is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, has low EPSS, and has no public exploit maturity reported, so it should be prioritized below actively exploited kernel flaws but still remediated through normal kernel update cycles, especially on systems that permit USB device attachment or use USB serial adapters.

How an attack unfolds

An attacker first needs a system where the kl5kusb105 USB serial driver is available and bound to a compatible USB serial device, or where a malicious/emulated USB device can cause the driver to load. The attacker then obtains the ability to write to the TTY exposed by that USB serial device, such as through local shell access, compromised software, or permissive device-node permissions. By writing a buffer of at least the bulk-out size, typically 64 bytes or more, the generic USB serial write path invokes klsi_105_prepare_write_buffer(). The vulnerable function writes a two-byte header and then copies too much user-controlled FIFO data into the bulk-out buffer, overflowing two bytes past the slab allocation. This can corrupt adjacent kernel heap memory and may result in a kernel oops, panic, or other instability. Reliable privilege escalation would require additional exploit development and favorable kernel memory layout conditions.

How to fix it

Apply a Linux kernel update from the relevant distribution, appliance, or vendor that includes the kl5kusb105 bulk-out buffer bounds fix. No exact fixed package versions were provided in the input, so use vendor advisories and changelogs to confirm the patch is included. If immediate patching is not possible and the driver is not required, disable or blacklist the kl5kusb105 module, for example by adding a modprobe blacklist entry for kl5kusb105 and rebuilding initramfs if the platform requires it. Reduce exposure by blocking untrusted USB devices, disabling unused USB ports where operationally feasible, and restricting write permissions to USB serial TTY device nodes to only trusted users and services. Systems that rely on KLSI KL5KUSB105-compatible USB serial adapters should be tested after patching to confirm normal serial operation.

How to confirm the fix worked

Confirm the running kernel is a vendor-fixed build that contains the corrected copy length in klsi_105_prepare_write_buffer(), where the payload copy is limited to size - KLSI_HDR_LEN rather than the full buffer size. Validate package status with the distribution package manager and compare the running kernel version against the vendor advisory, not only the installed package list. Check whether the kl5kusb105 module is present or loaded using tools such as lsmod, modinfo, or /sys/module/kl5kusb105. If the driver was blacklisted as mitigation, verify it cannot be loaded automatically and that compatible USB serial devices no longer bind to it. For regression testing in a controlled lab, writing 64 bytes or more to a bound test TTY should no longer produce KASAN, kernel oops, or slab out-of-bounds messages.

Typical attack path

1. Identify a Linux system that has the kl5kusb105 USB serial driver present or can be induced to load it through a compatible USB serial device.
2. Attach or emulate a compatible USB serial device, or wait for a legitimate device using the driver to be present.
3. Gain permission to write to the corresponding /dev/ttyUSB* or similar serial TTY device node.
4. Write 64 bytes or more to the TTY so the vulnerable bulk-out preparation path is reached.
5. Trigger the out-of-bounds write in klsi_105_prepare_write_buffer().
6. Cause kernel memory corruption, most commonly resulting in a crash or denial of service; further exploitation would require chaining the corruption into controlled kernel execution.

How to detect it

Look for evidence of prior kernel memory corruption or crashes associated with the kl5kusb105 USB serial driver. Useful sources include journald, /var/log/kern.log, /var/log/messages, dmesg output, crash dump repositories, pstore/ramoops logs, KASAN reports, EDR telemetry for kernel panics, and USB device connection logs. Search for kernel warnings or oops traces containing klsi_105_prepare_write_buffer, kl5kusb105, kfifo_copy_out, usb_serial_generic_write_start, or slab-out-of-bounds. Correlate any such events with USB device insertions, creation of /dev/ttyUSB* devices, and processes writing to those device nodes around the same time. On systems with auditd or comparable telemetry, review write activity to USB serial TTYs, especially repeated writes of 64 bytes or larger before a crash. There are no known network indicators for this vulnerability because exploitation is local/device-path oriented rather than network-facing. The original report demonstrated the bug using dummy_hcd and raw-gadget; their presence on production systems may indicate USB gadget testing or emulation and should be reviewed in context, but they are not by themselves proof of exploitation.

• BUG: KASAN: slab-out-of-bounds in kfifo_copy_out
• KASAN: slab-out-of-bounds
• klsi_105_prepare_write_buffer [kl5kusb105]
• usb_serial_generic_write_start [usbserial]
• Write of size 64
• kl5kusb105
• /sys/module/kl5kusb105
• dummy_hcd
• raw-gadget

What your security team should do

• Inventory Linux systems where USB device attachment is allowed or where USB serial adapters are used, especially engineering workstations, kiosks, lab systems, industrial gateways, and embedded Linux devices.
• Patch affected Linux kernels through standard vendor channels and prioritize systems with local multi-user access, exposed physical USB ports, or workloads that interact with USB serial hardware.
• If the driver is unnecessary, blacklist kl5kusb105 as a near-term mitigation and confirm the module is not loaded after reboot.
• Restrict access to /dev/ttyUSB* and other USB serial device nodes using udev rules, group membership review, and least-privilege service accounts.
• Monitor kernel logs for slab out-of-bounds, KASAN, oops, or panic messages involving kl5kusb105, klsi_105_prepare_write_buffer, kfifo_copy_out, or usb_serial_generic_write_start.
• Treat suspicious crashes involving this driver as potential local exploitation or malicious USB activity and preserve kernel logs, crash dumps, loaded-module lists, and USB device history.
• Because this issue is not currently KEV-listed and has low EPSS, coordinate remediation with normal kernel maintenance unless the organization has high USB exposure or sensitive systems using this driver.