The vulnerability in the Linux kernel USB serial io_ti driver arises from a heap overflow in the build_i2c_fw_hdr() function. This function allocates a fixed-size buffer and copies a length of data specified by img_header->Length from the firmware image without ensuring that this length fits within the allocated buffer. Although the total firmware size is validated by check_fw_sanity(), the specific Length field is not checked, allowing an attacker to supply a malicious firmware image that triggers a heap overflow. The fix involves rejecting firmware images where img_header->Length exceeds the destination buffer size.

Successful exploitation could lead to heap memory corruption, potentially allowing an attacker with limited privileges to execute arbitrary code, cause denial of service, or escalate privileges. The CVSS vector indicates local attack vector with low complexity, requiring low privileges, no user interaction, and results in high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description states a fix by rejecting oversized firmware images, but no explicit patch or update link is provided. Users should monitor Microsoft Security Response Center advisories for official patches or updates addressing this issue.