CVE-2026-64334 Linux CVE debrief

Who should care

Users of the Linux kernel, particularly those using the USB: serial: digi_acceleport driver, should be aware of this vulnerability and take steps to ensure their systems are updated. System administrators and security teams responsible for Linux kernel deployments should review the vulnerability and implement necessary updates or mitigations.

Technical summary

The vulnerability is caused by a persistent failure in submitting the OOB write urb in the USB: serial: digi_acceleport driver. This can cause the driver to loop indefinitely with interrupts disabled, leading to a hard lockup on disconnect. The issue can be triggered when open(), set_termios(), or close() races with a physical disconnect. To address this, a check for urb submission errors was added when sending OOB commands. This change helps prevent the driver from hanging indefinitely.

Defensive priority

Medium

Recommended defensive actions

• Update the Linux kernel to the latest version
• Ensure the USB: serial: digi_acceleport driver is updated
• Monitor system logs for signs of the hard lockup issue
• Review system configurations for potential exposure
• Verify that compensating controls are in place for exposed systems
• Track exceptions and retest remediated assets
• Close the item only after evidence is documented

Evidence notes

The vulnerability was flagged by Sashiko when reviewing an unrelated change to the driver. The issue was resolved by adding a check for urb submission errors when sending OOB commands. This change helps prevent the driver from looping indefinitely with interrupts disabled. Users should verify their systems are updated and monitor for signs of the hard lockup issue. The vulnerability highlights the importance of robust error handling in USB serial drivers.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.