CVE-2026-80827USB: serial: option: fix slab OOB read in interrupt URB callback
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: USB: serial: option: fix slab OOB read in interrupt URB callback The interrupt URB buffer is allocated in setup_port_interrupt_in() based on the endpoint's wMaxPacketSize: buffer_size = usb_endpoint_maxp(epd); port->interrupt_in_buffer = kmalloc(buffer_size, GFP_KERNEL); When a USB device declares wMaxPacketSize = 8 on its interrupt IN endpoint, the buffer is allocated from kmalloc-8 cache (exactly 8 bytes). If the device sends a short packet (actual_length < wMaxPacketSize), the URB completes with status == 0 and the callback proceeds to read: data[sizeof(struct usb_ctrlrequest)] which evaluates to data[8], accessing 1 byte beyond the allocated 8-byte buffer. This results in a slab out-of-bounds read. Fix this by adding the missing bounds check: first verify that the actual length is large enough to contain the struct usb_ctrlrequest header before accessing req_pkt->bRequestType and req_pkt->bRequest, and then verify that there is an additional byte for the modem signal state before reading data[sizeof(struct usb_ctrlrequest)] inside the conditional. Use sizeof(*req_pkt) instead of sizeof(struct usb_ctrlrequest) for consistency. [ johan: use dev_err(); split signals declaration and initialisation ]
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 4, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 58cfe9113e485f7e04bd0eac4fc4251b330af501 before fbe60fd2abc8a5561f39719a41ad9a01b5d8e567; from 58cfe9113e485f7e04bd0eac4fc4251b330af501 before 94e5525697b9e91ddc4071129874120a50a4f342; 58cfe9113e485f7e04bd0eac4fc4251b330af501 builds before 6b8cf5422c7e96ed5b22a8368eff663f3f98b8ec; 58cfe9113e485f7e04bd0eac4fc4251b330af501 builds before 030e3a73d3c3aa67c44454649e984d6383cdb7d3; from 58cfe9113e485f7e04bd0eac4fc4251b330af501 before 060db7d48af1e650643c8b8319111a9ea2ce4486; 58cfe9113e485f7e04bd0eac4fc4251b330af501 builds before 2ef5560387f2c0713cee975be2b24b281bd90f3e; from 58cfe9113e485f7e04bd0eac4fc4251b330af501 before a72a13c83a652516a0e469d275b81d29a7429049; from 58cfe9113e485f7e04bd0eac4fc4251b330af501 before d762aef4eba354066be21a5d88eb2066e282f4c9; and 1 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/fbe60fd2abc8a5561f39719a41ad9a01b5d8e567
- https://git.kernel.org/stable/c/94e5525697b9e91ddc4071129874120a50a4f342
- https://git.kernel.org/stable/c/6b8cf5422c7e96ed5b22a8368eff663f3f98b8ec
- https://git.kernel.org/stable/c/030e3a73d3c3aa67c44454649e984d6383cdb7d3
- https://git.kernel.org/stable/c/060db7d48af1e650643c8b8319111a9ea2ce4486
- https://git.kernel.org/stable/c/2ef5560387f2c0713cee975be2b24b281bd90f3e
- https://git.kernel.org/stable/c/a72a13c83a652516a0e469d275b81d29a7429049
- https://git.kernel.org/stable/c/d762aef4eba354066be21a5d88eb2066e282f4c9
- https://git.kernel.org/stable/c/885d802f544ca7bfa8f3984d94233cce715bb6b3
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.