CVE-2026-64333

CVE-2026-64333 is a self-corrupting flaw in the Digi Acceleport USB serial driver (digi_write_inb_command). When a write URB times out, the function fails to return cleanly — it corrupts its own transfer buffer and attempts to resubmit an URB already in flight. This is a direct violation of the driver's internal locking assumptions, not traditional memory corruption you can inject from userspace. The trigger mechanism is architecture-dependent in a way the CVSS score doesn't capture. On 32-bit systems, the INITIAL_JIFFIES offset creates a predictable ~5-minute window where the broken jiffies comparison silently passes. After that window closes, the break-control code path triggers immediate buffer corruption with no timeout protection. On 64-bit systems, this specific trigger doesn't exist in the same form, though the underlying race condition (the driver losing track of buffer ownership during the URB lifecycle) persists. For practical assessment: identify whether any Digi Acceleport USB serial devices are connected to your systems. If they are and you're running a 32-bit kernel, any serial session exceeding five minutes enters vulnerable territory. The corruption manifests as data loss or malformed commands on the serial line — not as a crash — which makes misdiagnosis likely. The downstream risk is the real concern. Serial ports in Linux environments often connect to industrial PLCs, SCADA equipment, HVAC controls, and legacy POS systems. A corrupted write buffer sends wrong data downstream to systems that implicitly trust the serial channel. If your serial链路 feeds into control systems without integrity checking, the blast radius extends beyond the driver itself. Priority: verify kernel version (patches landed in recent kernel releases), audit any Digi USB serial deployments, and treat this as a reliability issue with security implications if the serial link feeds into operational technology.

Reviewed through automated stages and approved by a human before publication.