Linux Kernel USB Serial Driver Write Buffer Corruption

CVE-2026-64333 is a critical buffer corruption vulnerability in the Linux kernel's digi_acceleport USB serial driver. The flaw exists in the digi_write_inb_command() function, which fails to properly synchronize access to write URBs (USB Request Blocks). Instead of correctly waiting for buffer availability or returning an error on timeout, the function overwrites active transfer buffers and attempts URB resubmission, leading to memory corruption. This vulnerability affects any system using Digi AccelePort USB serial devices, including industrial control systems, medical devices, and embedded Linux deployments that rely on this driver for serial communication.

While CVE-2026-64333 lacks mapped MITRE ATT&CK techniques and CWE classification, Casky's Claude-powered analysis would identify this as a memory safety issue enabling potential code execution through techniques like T1190 (Exploit Public-Facing Application) or T1203 (Exploitation for Client Execution). Practitioners using Casky would detect anomalies in kernel memory writes, unexpected USB driver behavior, and potential privilege escalation attempts stemming from buffer overflow exploitation. The vulnerability's presence—particularly on 32-bit systems with broken jiffies comparison logic—represents a kernel-level attack surface requiring immediate patching, with detection focused on monitoring USB device driver interactions and kernel panic signatures.