CVE-2026-64333

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-64333

Key Details

CVE	CVE-2026-64333
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel
Classified as	CWE-787 (Out-of-bounds Write)

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: digi_acceleport: fix write buffer corruption

The digi_write_inb_command() is supposed to wait for the write urb to

become available or return an error, but instead it updates the transfer

buffer and tries to resubmit the urb on timeout.

To make things worse, for commands like break control where no timeout

is used, the driver would corrupt the urb immediately due to a broken

jiffies comparison (on 32-bit machines this takes five minutes of uptime

to trigger due to INITIAL_JIFFIES).

Fix this by adding the missing return on timeout and waiting

indefinitely when no timeout has been specified as intended.

This issue was (sort of) flagged by Sashiko when reviewing an unrelated

change to the driver. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-64333
CVE	https://www.cve.org/CVERecord?id=CVE-2026-64333

Source

Reference

NVD

CVE