CVE-2026-53195

HighCVSS 7.8/10Last modified Nov 6, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()

build_i2c_fw_hdr() allocates a fixed-size buffer of (16*1024 - 512) + sizeof(struct ti_i2c_firmware_rec) bytes, then copies le16_to_cpu(img_header->Length) bytes into it without validating that Length fits within the available space after the firmware record header.

img_header->Length is a __le16 from the firmware file and can be up to 65535. check_fw_sanity() validates the total firmware size but not img_header->Length specifically.

Fix by rejecting images where img_header->Length exceeds the available destination space.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
LinuxLinux>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 3e187152f44d76d7633a3855ffd0099e1588b82a; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < b7faf660eefa2047ebc2959ff76da2b6eae2e9e3; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 2fd64bf0ad66ab5de0c73524591d879427ba5aba; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 4cb722747ed25971f35cc47ce5c0e79d7f717713; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 130d6567eb148040eed1b73e1414ad6c27d22bd5; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 294692d3296eee3391c348d7ea6401916d27806c; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 5a79b634ee58786ca627268daefa7744f2af2e14; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 0fd2b00b2d3d05e3eaa13342b3dfb0fa85c226ae
LinuxLinux2.6.12

References

Timeline

Published
Jun 25, 2026
Last modified
Nov 6, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-531966.8In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf_inCVE-2026-531975.5In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state() iptfs_destroy_CVE-2026-531988.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCELCVE-2026-531997.5In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf netvsc_copy_CVE-2026-53207.3A vulnerability was detected in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is an unknown functionality of the file /api/vannCVE-2026-532008.8In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX XN has already beCVE-2026-532017.8In the Linux kernel, the following vulnerability has been resolved: Revert "drm/xe: Skip exec queue schedule toggle if queue is idle duringCVE-2026-532027.8In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix signed integer truncation in IPC receive Fix potentialCVE-2026-532037.1In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add buffer overflow check in MS get_info_ioctl Add validatCVE-2026-532045.5In the Linux kernel, the following vulnerability has been resolved: firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in prCVE-2026-532057.1In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds checks for firmware log indices Add validation CVE-2026-532065.5In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds check for firmware runtime memory Validate that
CVE-2026-53195: High severity, CVSS 7.8 | Vulnix