Skip to content
Heist/ feed
Back to feed
UnratedFix available

USB: serial: keyspan_pda: fix information leak

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspan_pda: fix information leak The write() callback is supposed to return the number of characters accepted or a negative errno. Since the addition of write fifo support the keyspan_pda implementation will however return the number characters submitted to the device if the write urb is not already in use. If this number is larger than the number of characters passed to write(), the line discipline continues writing data from beyond the tty write buffer. Fix the information leak by making sure that keyspan_pda_write_start() returns zero on success as intended.

Products
Kernel
Affected versions
Not specified
Fixed versions
5.15.212, 6.1.178, 6.12.96, 6.18.39, 6.6.145, 7.1.4
CVEs
CVE-2026-64336
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 04:48 UTC · Revision 1

Source evidence

USB: serial: keyspan_pda: fix information leak

core-osv · Original source

Published 25 Jul 2026, 08:50 UTC

In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspan_pda: fix information leak The write() callback is supposed to return the number of characters accepted or a negative errno. Since the addition of write fifo support the keyspan_pda implementation will however return the number characters submitted to the device if the write urb is not already in use. If this number is larger than the number of characters passed to write(), the line discipline continues writing data from beyond the tty write buffer. Fix the information leak by making sure that keyspan_pda_write_start() returns zero on success as intended.

osv:CVE-2026-64336

Kernel

Fixed versions: 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4

Complete source record
{
  "id": "fe0d2f76c124984c74f69710ed68deb46366b817afe73ff4f57a645b1a0262b0",
  "url": "https://osv.dev/vulnerability/CVE-2026-64336",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "USB: serial: keyspan_pda: fix information leak",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspan_pda: fix information leak The write() callback is supposed to return the number of characters accepted or a negative errno. Since the addition of write fifo support the keyspan_pda implementation will however return the number characters submitted to the device if the write urb is not already in use. If this number is larger than the number of characters passed to write(), the line discipline continues writing data from beyond the tty write buffer. Fix the information leak by making sure that keyspan_pda_write_start() returns zero on success as intended.",
    "evidence": "osv:CVE-2026-64336",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.15.212",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.178",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.145",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.96",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.39",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "7.1.4",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-64336",
      "aliases": [
        "CVE-2026-64336"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "034e38e8f68767fb5438ae3e608ee82919674177"
                },
                {
                  "fixed": "b069b7029862fafaff331d4c664d97d4ae828d6d"
                },
                {
                  "fixed": "e52ca411f50539ff1d0c877b9312771ca8a858c1"
                },
                {
                  "fixed": "2f7a6b8ab3845bd1da02604f1a874b52a4555a72"
                },
                {
                  "fixed": "e1494191a3aac665d3a2fce16169a97c346253ec"
                },
                {
                  "fixed": "cf6ca0aefae03958cfb5b189b0adbfb25c06bfac"
                },
                {
                  "fixed": "d4b12b6b395e43a2b1d80be3745631fcaa9c047b"
                },
                {
                  "fixed": "6bfc8d01ac4068eced509f8fc74d0cd205e4dcec"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "5.10.266"
                },
                {
                  "fixed": "5.11"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "02407bc7d42347da7ed2a3926a0b824bfc614914"
                }
              ]
            }
          ],
          "versions": [
            "v5.10.272",
            "v5.10.271",
            "v5.10.270",
            "v5.10.269",
            "v5.10.268",
            "v5.10.267",
            "v5.10.266"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64336.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.212"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.178"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.145"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.96"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.39"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "7.1.4"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64336.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:49.814865521Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/2f7a6b8ab3845bd1da02604f1a874b52a4555a72",
        "https://git.kernel.org/stable/c/6bfc8d01ac4068eced509f8fc74d0cd205e4dcec",
        "https://git.kernel.org/stable/c/b069b7029862fafaff331d4c664d97d4ae828d6d",
        "https://git.kernel.org/stable/c/cf6ca0aefae03958cfb5b189b0adbfb25c06bfac",
        "https://git.kernel.org/stable/c/d4b12b6b395e43a2b1d80be3745631fcaa9c047b",
        "https://git.kernel.org/stable/c/e1494191a3aac665d3a2fce16169a97c346253ec",
        "https://git.kernel.org/stable/c/e52ca411f50539ff1d0c877b9312771ca8a858c1",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64336.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-64336",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64336.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-64336",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 518259,
  "published_at": "2026-07-25T08:50:01.444+00:00"
}