Cloudanix VulnDB

CVE-2026-80827

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug can let specially made USB devices read a little extra memory they should not, which might make the computer unstable or leak small amounts of information.

Exploitation
Physical Access
Attacker needs
Physical Access
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Slab out-of-bounds read in the Linux kernel USB serial option driver's interrupt URB callback, triggered when a device declares wMaxPacketSize=8 but sends a short packet allowing access to data[8] beyond the kmalloc-8 buffer.

Why it matters to the business

Kernel instability, potential crashes, or limited memory disclosure on Linux systems connected to certain USB serial or modem devices, increasing operational risk for hardware-dependent environments.

How an attack unfolds

An attacker supplies a crafted USB device that reports a small interrupt endpoint packet size and responds with a short packet; the option driver allocates an undersized buffer and the URB completion handler performs an unchecked read past the end when parsing a usb_ctrlrequest header plus modem signals.

How to fix it

Apply the upstream kernel patch adding bounds checks before accessing req_pkt->bRequestType, req_pkt->bRequest, and data[sizeof(*req_pkt)]; rebuild and deploy the fixed kernel image to all affected hosts.

How to confirm the fix worked

Confirm presence of the added length checks on actual_length versus sizeof(struct usb_ctrlrequest) plus the extra byte for modem state in setup_port_interrupt_in and option_instat_callback; test with a device sending short packets and verify no OOB access occurs.

Typical attack path

  1. Prepare malicious USB device declaring wMaxPacketSize of 8 bytes on interrupt IN endpoint
  2. Connect device to target Linux system exposing the option serial driver
  3. Device sends short packet causing URB status==0 with actual_length < 8
  4. Interrupt callback executes data[sizeof(struct usb_ctrlrequest)] read without bounds validation
  5. Resulting slab OOB read may leak adjacent kernel memory or trigger a crash

How to detect it

Search kernel logs and dmesg for option driver URB callbacks, slab out-of-bounds warnings, or kmalloc-8 buffer references around USB device connect events; correlate with recent attachment of serial or modem class devices.

  • option: interrupt URB buffer too small
  • slab out-of-bounds read in option_instat_callback
  • usb_endpoint_maxp.*interrupt.*8
  • kmalloc-8.*actual_length < 8

What your security team should do

  • Prioritize kernel update on systems exposing USB serial ports or handling untrusted USB devices
  • Restrict physical or logical attachment of unknown USB hardware until patched
  • Monitor kernel logs for slab allocation warnings or option driver errors during USB enumeration

The record

In the Linux kernel, the following vulnerability has been resolved: USB: serial: option: fix slab OOB read in interrupt URB callback The interrupt URB buffer is allocated in setup_port_interrupt_in() based on the endpoint's wMaxPacketSize: buffer_size = usb_endpoint_maxp(epd); port->interrupt_in_buffer = kmalloc(buffer_size, GFP_KERNEL); When a USB device declares wMaxPacketSize = 8 on its interrupt IN endpoint, the buffer is allocated from kmalloc-8 cache (exactly 8 bytes). If the device sends a short packet (actual_length < wMaxPacketSize), the URB completes with status == 0 and the callback proceeds to read: data[sizeof(struct usb_ctrlrequest)] which evaluates to data[8], accessing 1 byte beyond the allocated 8-byte buffer. This results in a slab out-of-bounds read. Fix this by adding the missing bounds check: first verify that the actual length is large enough to contain the struct usb_ctrlrequest header before accessing req_pkt->bRequestType and req_pkt->bRequest, and then verify that there is an additional byte for the modem signal state before reading data[sizeof(struct usb_ctrlrequest)] inside the conditional. Use sizeof(*req_pkt) instead of sizeof(struct usb_ctrlrequest) for consistency. [ johan: use dev_err(); split signals declaration and initialisation ]

Affected packages

Ecosystem Package Introduced Fixed