CVE-2026-80827 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: option: fix slab OOB read in interrupt URB callback
The interrupt URB buffer is allocated in setup_port_interrupt_in() based on the endpoint's wMaxPacketSize:
buffer_size = usb_endpoint_maxp(epd); port->interrupt_in_buffer = kmalloc(buffer_size, GFP_KERNEL);
When a USB device declares wMaxPacketSize = 8 on its interrupt IN endpoint, the buffer is allocated from kmalloc-8 cache (exactly 8 bytes).
If the device sends a short packet (actual_length < wMaxPacketSize), the URB completes with status == 0 and the callback proceeds to read:
data[sizeof(struct usb_ctrlrequest)]
which evaluates to data[8], accessing 1 byte beyond the allocated 8-byte
buffer. This results in a slab out-of-bounds read.
Fix this by adding the missing bounds check: first verify that the actual length is large enough to contain the struct usb_ctrlrequest header before accessing req_pkt->bRequestType and req_pkt->bRequest, and then verify that there is an additional byte for the modem signal state before reading data[sizeof(struct usb_ctrlrequest)] inside the
conditional. Use sizeof(*req_pkt) instead of sizeof(struct usb_ctrlrequest) for consistency.
[ johan: use dev_err(); split signals declaration and initialisation ]
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel driver for USB serial devices, specifically within the option module, contained a critical memory safety flaw related to buffer boundary validation during interrupt transfer completion handling. This vulnerability manifests as an out-of-bounds read operation that occurs when processing data from USB device endpoints configured with specific packet size characteristics. The root cause lies in the initialization phase where the driver allocates a receive buffer for interrupt input transfers based strictly on the endpoint's declared maximum packet size, retrieved via usb_endpoint_maxp. When a connected USB device advertises a wMaxPacketSize of eight bytes, the kernel allocator reserves exactly eight bytes from the kmalloc-8 cache slab. This allocation is precise and leaves no margin for error or additional data parsing beyond that fixed limit.
The operational failure occurs during the interrupt URB callback routine when the USB subsystem reports successful completion with a status code indicating success but providing an actual transfer length shorter than the maximum packet size. In such scenarios, known as short packets, the driver proceeds to parse the received buffer without verifying whether it contains sufficient data for the expected protocol structures. Specifically, the code attempts to access memory at offset eight within the buffer by reading data[sizeof(struct usb_ctrlrequest)]. Since struct usb_ctrlrequest is typically eight bytes in size on many architectures, this operation targets index eight of an array that only has valid indices zero through seven. Consequently, the kernel reads one byte beyond the allocated boundary, resulting in a slab out-of-bounds read vulnerability. This type of memory access violation can lead to information disclosure if the adjacent memory contains sensitive data, or potentially cause instability depending on how the accessed value is utilized subsequently.
From a classification perspective, this flaw aligns with CWE-125, which defines Out-of-Bounds Read vulnerabilities where software reads past the end or before the beginning of the intended buffer. In terms of adversarial tactics, this vulnerability could be leveraged within an ATT&CK framework context to facilitate data exfiltration through memory scraping techniques if exploited in a privileged kernel context. The lack of proper length validation prior to structure parsing represents a fundamental failure in input sanitization and boundary checking principles that are critical for robust driver development. Such oversights allow malicious or malformed USB devices, which may be physically connected by an attacker or introduced via compromised peripherals, to trigger undefined behavior within the kernel space.
The remediation strategy implemented involves introducing rigorous bounds checking before any access to the buffer contents is attempted. The fix ensures that the actual length of data received from the device is first validated against the size required for the usb_ctrlrequest structure header. Only after confirming that this minimum threshold is met does the code proceed to evaluate modem signal states and other protocol-specific fields. Furthermore, the correction standardizes the use of sizeof(*req_pkt) instead of hardcoding struct sizes, which enhances maintainability and reduces the risk of future mismatches between type definitions and size calculations. This defensive programming approach guarantees that memory accesses remain within the allocated limits regardless of whether short packets are received from compliant or non-compliant USB devices.
To mitigate similar risks in broader systems environments, it is essential to ensure that kernel updates containing this fix are applied promptly on all affected Linux distributions. System administrators should monitor for patches related to usbserial and option drivers. For developers writing or maintaining USB device drivers, the primary lesson involves always validating actual transfer lengths against expected structure sizes before dereferencing pointers into those buffers. Adhering strictly to these validation protocols prevents out-of-bounds accesses that could otherwise be exploited by malicious hardware peripherals to compromise system integrity or extract sensitive kernel memory contents.