In the Linux kernel, the following vulnerability has been resolved:
USB: serial: ioti: fix heap overflow in getmanuf_info()
getmanufinfo() reads le16tocpu(romdesc->Size) bytes from the device I2C EEPROM into a buffer allocated with kmallocobj(), which is sizeof(struct edgetimanuf_descriptor) = 10 bytes.
The Size field comes from the device and is only validated (in checki2cimage()) to make sure the descriptor fits within TIMAXI2C_SIZE (16384 bytes), not against the destination buffer size. A malicious USB device can therefore set Size to any value up to 16377, causing a heap overflow of up to 16367 bytes when plugged into a host running this driver.
validcsum() is called after readrom() and also iterates buffer[0..Size-1], compounding the out-of-bounds access.
Fix by rejecting descriptors with unexpected length before calling read_rom().
[ johan: amend commit message; also check for short descriptors ]
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53196.json"
}