CVE-2026-80827

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: option: fix slab OOB read in interrupt URB callback

The interrupt URB buffer is allocated in setup_port_interrupt_in() based

on the endpoint's wMaxPacketSize:

buffer_size = usb_endpoint_maxp(epd);

port->interrupt_in_buffer = kmalloc(buffer_size, GFP_KERNEL);

When a USB device declares wMaxPacketSize = 8 on its interrupt IN

endpoint, the buffer is allocated from kmalloc-8 cache (exactly

8 bytes).

If the device sends a short packet (actual_length < wMaxPacketSize),

the URB completes with status == 0 and the callback proceeds to read:

data[sizeof(struct usb_ctrlrequest)]

which evaluates to data[8], accessing 1 byte beyond the allocated 8-byte

buffer. This results in a slab out-of-bounds read.

Fix this by adding the missing bounds check: first verify that the

actual length is large enough to contain the struct usb_ctrlrequest

header before accessing req_pkt->bRequestType and req_pkt->bReque

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References