CVE-2026-68365

What it actually does

Unbounded accumulation of transmit credits reported in interrupt-status packets allows txCredits to exceed maxTxCredits, causing edge_write() to compute an oversized write length into the software FIFO ring buffer and perform an out-of-bounds write.

Why it matters to the business

Kernel memory corruption on systems exposing the io_edgeport USB serial driver can produce crashes, denial of service, or potential kernel-level code execution when affected USB devices are attached.

How an attack unfolds

An attacker presents a USB device that returns crafted interrupt packets containing credit values larger than the allocated max; subsequent calls to edge_write() then write past the ring-buffer bounds.

How to fix it

Apply a kernel update containing the credit-capping change in edge_interrupt_callback(); rebuild and reboot with the patched kernel on all affected systems.

How to confirm the fix worked

Inspect the edge_interrupt_callback() implementation to confirm credits are now capped at maxTxCredits before addition; test with a device that would previously have sent oversized credits and verify no overflow occurs.

Typical attack path

1. Attach a USB device that triggers the io_edgeport driver
2. Send interrupt-status packets reporting excessive transmit credits
3. Issue write operations that calculate and perform an out-of-bounds ring-buffer write

How to detect it

Monitor kernel logs for io_edgeport-related messages, USB interrupt callbacks, and any ring-buffer or memory corruption warnings; correlate with unexpected USB device enumeration events.

What your security team should do

• Identify hosts that load the io_edgeport module and schedule kernel updates
• Restrict physical or logical attachment of untrusted USB serial devices until patched
• Review kernel update policies to reduce time-to-patch for USB serial drivers