CVE-2026-80827
Received Received - Intake

USB: serial: option driver slab out-of-bounds read in URB callback

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: USB: serial: option: fix slab OOB read in interrupt URB callback The interrupt URB buffer is allocated in setup_port_interrupt_in() based on the endpoint's wMaxPacketSize: buffer_size = usb_endpoint_maxp(epd); port->interrupt_in_buffer = kmalloc(buffer_size, GFP_KERNEL); When a USB device declares wMaxPacketSize = 8 on its interrupt IN endpoint, the buffer is allocated from kmalloc-8 cache (exactly 8 bytes). If the device sends a short packet (actual_length < wMaxPacketSize), the URB completes with status == 0 and the callback proceeds to read: data[sizeof(struct usb_ctrlrequest)] which evaluates to data[8], accessing 1 byte beyond the allocated 8-byte buffer. This results in a slab out-of-bounds read. Fix this by adding the missing bounds check: first verify that the actual length is large enough to contain the struct usb_ctrlrequest header before accessing req_pkt->bRequestType and req_pkt->bRequest, and then verify that there is an additional byte for the modem signal state before reading data[sizeof(struct usb_ctrlrequest)] inside the conditional. Use sizeof(*req_pkt) instead of sizeof(struct usb_ctrlrequest) for consistency. [ johan: use dev_err(); split signals declaration and initialisation ]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80827
EUVD
EUVD-2026-71277

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a slab out-of-bounds read vulnerability in the Linux kernel's USB serial option driver. It occurs when a USB device with an interrupt IN endpoint declaring wMaxPacketSize=8 sends a short packet. The driver allocates an 8-byte buffer but then reads 8 bytes plus 1 more byte beyond the buffer when processing the URB callback, causing memory corruption.

Detection Guidance

This vulnerability is specific to USB serial devices using the Linux kernel's option driver. Detection requires checking kernel logs for slab out-of-bounds read errors related to USB interrupt URBs. Monitor dmesg for errors like 'option: slab OOB read in interrupt URB callback' after connecting suspect USB devices.

Impact Analysis

This vulnerability could allow an attacker with physical access to a vulnerable system to potentially cause a kernel crash or execute arbitrary code with kernel privileges. It may lead to denial of service or privilege escalation on affected systems.

Compliance Impact

This vulnerability is a slab out-of-bounds read in the Linux kernel's USB serial option driver. It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy. However, if exploited, it could potentially lead to system instability or crashes, indirectly impacting systems handling sensitive data.

Mitigation Strategies

Apply the Linux kernel patch that adds bounds checking in the option driver's interrupt URB callback. Update to a kernel version containing the fix (CVE-2026-80827). If immediate patching isn't possible, avoid using untrusted USB serial devices until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80827. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart