CVE-2026-64336

What it actually does

This flaw is an information disclosure bug in the Linux kernel USB serial driver for Keyspan PDA devices, `keyspan_pda`. The driver’s `write()` path can incorrectly report that it accepted more bytes than were actually supplied by the TTY write buffer. When that happens, the TTY line discipline may continue transmitting data from beyond the intended buffer boundary, potentially leaking adjacent kernel memory or stale in-memory data to the attached USB serial device or serial endpoint. The issue is local/physical or device-adjacent in nature and depends on the vulnerable driver being present and used; it is not a typical network-remotely exploitable kernel flaw.

Why it matters to the business

Organizations using Linux systems with Keyspan PDA USB serial support enabled could unintentionally expose sensitive in-memory data to a connected USB serial device or an attacker with access to such a device path. The practical risk is lower than many remotely exploitable kernel vulnerabilities because exploitation requires local access, physical USB access, or control of the attached device, and current public exploit maturity is reported as none with low EPSS. However, kernel information leaks can still matter in high-assurance, kiosk, lab, industrial, or shared-workstation environments because leaked memory may help bypass defenses or expose secrets handled by the host.

How an attack unfolds

An attacker first needs a system running a vulnerable Linux kernel with the `keyspan_pda` USB serial driver available and a compatible or malicious USB serial device bound to that driver. The attacker then needs the ability to interact with the associated TTY device, commonly exposed as a `/dev/ttyUSB*` node, or control the USB-side endpoint receiving data from the host. By issuing writes that cause the driver’s write FIFO logic to return a larger byte count than the caller actually provided, the attacker can cause the TTY subsystem to continue sending bytes past the legitimate write buffer. Those extra bytes may contain residual kernel memory or other unintended data, which the attacker captures from the USB/serial side. Exploitation does not directly provide code execution or privilege escalation, but the disclosed data could potentially support follow-on attacks depending on what memory is exposed.

How to fix it

Upgrade to a Linux kernel version from the relevant distribution or vendor that includes the upstream fix for `USB: serial: keyspan_pda: fix information leak`. Because no exact fixed package versions were provided, use vendor advisories and kernel changelogs to identify a build that references this CVE or the Keyspan PDA USB serial information leak fix. Where immediate patching is not possible, mitigate by disabling or blocklisting the `keyspan_pda` module if Keyspan PDA USB serial devices are not required, restricting access to `/dev/ttyUSB*` devices to trusted users only, preventing untrusted USB devices with controls such as USBGuard or device authorization policies, and avoiding use of affected USB serial hardware on systems handling sensitive data.

How to confirm the fix worked

Confirm remediation by verifying the running kernel package includes the vendor fix for the Keyspan PDA USB serial information leak and that the system has been rebooted into the fixed kernel. Check kernel package changelogs, distribution security advisories, or source patches for the text `USB: serial: keyspan_pda: fix information leak` or the associated CVE. Validate exposure reduction by confirming whether the module is loaded with `lsmod | grep keyspan_pda`, whether it is present with `modinfo keyspan_pda`, whether it is blocklisted where unused, and whether compatible devices create `/dev/ttyUSB*` interfaces. For mitigated systems, verify untrusted USB serial devices are denied or require explicit authorization and that only approved groups can access TTY USB device nodes.

Typical attack path

1. Identify or introduce a Keyspan PDA-compatible USB serial device on a Linux host using the vulnerable kernel driver.
2. Ensure the `keyspan_pda` driver is loaded and bound to the device, producing a TTY interface such as `/dev/ttyUSB0`.
3. Obtain permission to write to the TTY device or control the attached USB/serial endpoint receiving host output.
4. Trigger the vulnerable write path with crafted write sizes/timing that cause the driver to report more accepted bytes than were actually supplied.
5. Capture unintended extra bytes transmitted beyond the legitimate TTY write buffer.
6. Analyze the leaked data for sensitive contents or information useful for bypassing protections in later attacks.

How to detect it

There are no reliable public exploit-specific indicators for this vulnerability, and exploitation may leave little or no distinctive trace beyond normal USB serial activity. To assess possible prior exposure, review kernel logs, system journals, audit logs, and endpoint telemetry for loading or use of the `keyspan_pda` driver, attachment of Keyspan PDA USB serial devices, creation of `/dev/ttyUSB*` interfaces, and unexpected writes to those interfaces by untrusted users or processes. Useful log sources include `journalctl -k`, `/var/log/kern.log`, `/var/log/messages`, `/var/log/syslog`, auditd logs for device-node access, udev logs, USB device-control logs, and EDR telemetry for module loading or TTY device access. Investigate events where the driver was loaded on systems where it is not expected, where USB serial devices were attached shortly before suspicious activity, or where non-administrative users/processes interacted with USB TTY devices. Memory contents leaked through this bug are unlikely to be recoverable from host logs; detection is therefore focused on identifying vulnerable driver use and suspicious USB serial interactions rather than confirming exact leaked data.

• keyspan_pda
• keyspan_pda.ko
• /sys/bus/usb-serial/drivers/keyspan_pda
• /dev/ttyUSB
• USB: serial: keyspan_pda
• Keyspan PDA
• usbserial: USB Serial support registered for Keyspan PDA
• modprobe keyspan_pda

What your security team should do

• Patch affected Linux kernel packages during the next available maintenance window, prioritizing systems that allow physical USB access, shared user access, kiosk use, lab use, or industrial USB serial connectivity.
• Inventory systems where the `keyspan_pda` module is present or loaded and determine whether Keyspan PDA USB serial support is actually required.
• Blocklist or remove the `keyspan_pda` module on systems that do not need it.
• Restrict permissions on `/dev/ttyUSB*` devices so only trusted users and services can write to USB serial interfaces.
• Use USB device control tooling, such as USBGuard or equivalent endpoint controls, to prevent untrusted USB serial adapters from binding to kernel drivers.
• Review kernel, udev, and audit logs for unexpected Keyspan PDA USB serial device attachment or module loading events, especially on sensitive workstations and servers.
• Treat this as lower urgency than actively exploited remote kernel bugs because it is not in CISA KEV, has no reported ransomware use, has no known public exploit maturity, and has low EPSS, but do not ignore it on systems exposed to untrusted physical access.