CVE-2026-64333: USB: serial: digi_acceleport: fix write buffer corruption

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: digi_acceleport: fix write buffer corruption

The digi_write_inb_command() is supposed to wait for the write urb to
become available or return an error, but instead it updates the transfer
buffer and tries to resubmit the urb on timeout.

To make things worse, for commands like break control where no timeout
is used, the driver would corrupt the urb immediately due to a broken
jiffies comparison (on 32-bit machines this takes five minutes of uptime
to trigger due to INITIAL_JIFFIES).

Fix this by adding the missing return on timeout and waiting
indefinitely when no timeout has been specified as intended.

This issue was (sort of) flagged by Sashiko when reviewing an unrelated
change to the driver.

The Linux kernel CVE team has assigned CVE-2026-64333 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.12 with commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and fixed in 5.10.261 with commit 5d9dc88bdf8897788b0eed57113e9eca7fd42ea9
	Issue introduced in 2.6.12 with commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and fixed in 5.15.212 with commit 2f296974acc279f05f284441bfe3064074958d11
	Issue introduced in 2.6.12 with commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and fixed in 6.1.178 with commit e60e4873e9178da9f4f2674e4c2ff085d5a84f79
	Issue introduced in 2.6.12 with commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and fixed in 6.6.145 with commit 699dfb6917503b3cda4d5da6941cf79c3c1b4c8b
	Issue introduced in 2.6.12 with commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and fixed in 6.12.96 with commit a274b3794fe1852c3d9fe6d900b94053c0b03410
	Issue introduced in 2.6.12 with commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and fixed in 6.18.39 with commit 1243f120790042c2ac92e84e797dacc75fff4366
	Issue introduced in 2.6.12 with commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and fixed in 7.1.4 with commit a3a13fdc53103b07335918e2cdeb465038a71725
	Issue introduced in 2.6.12 with commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and fixed in 7.2-rc3 with commit 24ca1fea8f2753bf33e1d458ec1ae5d9b7796a65

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64333
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/usb/serial/digi_acceleport.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/5d9dc88bdf8897788b0eed57113e9eca7fd42ea9
	https://git.kernel.org/stable/c/2f296974acc279f05f284441bfe3064074958d11
	https://git.kernel.org/stable/c/e60e4873e9178da9f4f2674e4c2ff085d5a84f79
	https://git.kernel.org/stable/c/699dfb6917503b3cda4d5da6941cf79c3c1b4c8b
	https://git.kernel.org/stable/c/a274b3794fe1852c3d9fe6d900b94053c0b03410
	https://git.kernel.org/stable/c/1243f120790042c2ac92e84e797dacc75fff4366
	https://git.kernel.org/stable/c/a3a13fdc53103b07335918e2cdeb465038a71725
	https://git.kernel.org/stable/c/24ca1fea8f2753bf33e1d458ec1ae5d9b7796a65