CVE-2026-80827: USB: serial: option: fix slab OOB read in interrupt URB callback
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: option: fix slab OOB read in interrupt URB callback
The interrupt URB buffer is allocated in setupportinterruptin() based on the endpoint's wMaxPacketSize:
buffersize = usbendpointmaxp(epd); port->interruptinbuffer = kmalloc(buffersize, GFPKERNEL);
When a USB device declares wMaxPacketSize = 8 on its interrupt IN endpoint, the buffer is allocated from kmalloc-8 cache (exactly 8 bytes).
If the device sends a short packet (actuallength < wMaxPacketSize), the URB completes with status == 0 and the callback proceeds to read:
data[sizeof(struct usbctrlrequest)]
which evaluates to data[8], accessing 1 byte beyond the allocated 8-byte buffer. This results in a slab out-of-bounds read.
Fix this by adding the missing bounds check: first verify that the actual length is large enough to contain the struct usbctrlrequest header before accessing reqpkt->bRequestType and reqpkt->bRequest, and then verify that there is an additional byte for the modem signal state before reading data[sizeof(struct usbctrlrequest)] inside the conditional. Use sizeof(reqpkt) instead of sizeof(struct usbctrlrequest) for consistency.
[ johan: use deverr(); split signals declaration and initialisation ]
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux systems using the USB serial option driver are exposed when they communicate with a USB device whose interrupt IN endpoint declares a wMaxPacketSize of 8. The triggering device then sends a short interrupt packet.
What conditions are required to trigger the out-of-bounds read?
The interrupt URB must complete successfully with a packet shorter than the endpoint maximum packet size. With an 8-byte endpoint buffer, the callback can read byte 8 after the USB control-request header, which is one byte beyond the allocated buffer.
How can I verify that the fix is present?
Inspect the option driver interrupt callback for checks that actual_length is at least sizeof(*req_pkt) before reading the request header, and that it contains one additional byte before reading the modem signal state. The listed stable kernel commits contain the remediation.