{"id":"CVE-2026-80827","title":"USB: serial: option: fix slab OOB read in interrupt URB callback","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: option: fix slab OOB read in interrupt URB callback\n\nThe interrupt URB buffer is allocated in setup_port_interrupt_in() based\non the endpoint's wMaxPacketS…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 58cfe9113e485f7e04bd0eac4fc4251b330af501 < fbe60fd2abc8a5561f39719a41ad9a01b5d8e567","Linux >= 58cfe9113e485f7e04bd0eac4fc4251b330af501 < 94e5525697b9e91ddc4071129874120a50a4f342","Linux >= 58cfe9113e485f7e04bd0eac4fc4251b330af501 < 6b8cf5422c7e96ed5b22a8368eff663f3f98b8ec","Linux >= 58cfe9113e485f7e04bd0eac4fc4251b330af501 < 030e3a73d3c3aa67c44454649e984d6383cdb7d3","Linux >= 58cfe9113e485f7e04bd0eac4fc4251b330af501 < 060db7d48af1e650643c8b8319111a9ea2ce4486","Linux >= 58cfe9113e485f7e04bd0eac4fc4251b330af501 < 2ef5560387f2c0713cee975be2b24b281bd90f3e","Linux >= 58cfe9113e485f7e04bd0eac4fc4251b330af501 < a72a13c83a652516a0e469d275b81d29a7429049","Linux >= 58cfe9113e485f7e04bd0eac4fc4251b330af501 < d762aef4eba354066be21a5d88eb2066e282f4c9","Linux >= 58cfe9113e485f7e04bd0eac4fc4251b330af501 < 885d802f544ca7bfa8f3984d94233cce715bb6b3","Linux 2.6.12"],"published":"2026-09-04","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:44:19.753Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80827","references":[{"url":"https://git.kernel.org/stable/c/fbe60fd2abc8a5561f39719a41ad9a01b5d8e567"},{"url":"https://git.kernel.org/stable/c/94e5525697b9e91ddc4071129874120a50a4f342"},{"url":"https://git.kernel.org/stable/c/6b8cf5422c7e96ed5b22a8368eff663f3f98b8ec"},{"url":"https://git.kernel.org/stable/c/030e3a73d3c3aa67c44454649e984d6383cdb7d3"},{"url":"https://git.kernel.org/stable/c/060db7d48af1e650643c8b8319111a9ea2ce4486"},{"url":"https://git.kernel.org/stable/c/2ef5560387f2c0713cee975be2b24b281bd90f3e"},{"url":"https://git.kernel.org/stable/c/a72a13c83a652516a0e469d275b81d29a7429049"},{"url":"https://git.kernel.org/stable/c/d762aef4eba354066be21a5d88eb2066e282f4c9"},{"url":"https://git.kernel.org/stable/c/885d802f544ca7bfa8f3984d94233cce715bb6b3"}],"tags":["cve.org"],"epss":0.00195,"epssPercentile":0.08588,"ingestedAt":"2026-10-19T09:16:01.502Z","slug":"CVE-2026-80827","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: option: fix slab OOB read in interrupt URB callback\n\nThe interrupt URB buffer is allocated in setup_port_interrupt_in() based\non the endpoint's wMaxPacketSize:\n\n    buffer_size = usb_endpoint_maxp(epd);\n    port->interrupt_in_buffer = kmalloc(buffer_size, GFP_KERNEL);\n\nWhen a USB device declares wMaxPacketSize = 8 on its interrupt IN\nendpoint, the buffer is allocated from kmalloc-8 cache (exactly\n8 bytes).\n\nIf the device sends a short packet (actual_length < wMaxPacketSize),\nthe URB completes with status == 0 and the callback proceeds to read:\n\n    data[sizeof(struct usb_ctrlrequest)]\n\nwhich evaluates to data[8], accessing 1 byte beyond the allocated 8-byte\nbuffer. This results in a slab out-of-bounds read.\n\nFix this by adding the missing bounds check: first verify that the\nactual length is large enough to contain the struct usb_ctrlrequest\nheader before accessing req_pkt->bRequestType and req_pkt->bRequest,\nand then verify that there is an additional byte for the modem signal\nstate before reading data[sizeof(struct usb_ctrlrequest)] inside the\nconditional.  Use sizeof(*req_pkt) instead of sizeof(struct\nusb_ctrlrequest) for consistency.\n\n[ johan: use dev_err(); split signals declaration and initialisation ]\n\n## Affected\n\n- `Linux >= 58cfe9113e485f7e04bd0eac4fc4251b330af501 < fbe60fd2abc8a5561f39719a41ad9a01b5d8e567`\n- `Linux >= 58cfe9113e485f7e04bd0eac4fc4251b330af501 < 94e5525697b9e91ddc4071129874120a50a4f342`\n- `Linux >= 58cfe9113e485f7e04bd0eac4fc4251b330af501 < 6b8cf5422c7e96ed5b22a8368eff663f3f98b8ec`\n- `Linux >= 58cfe9113e485f7e04bd0eac4fc4251b330af501 < 030e3a73d3c3aa67c44454649e984d6383cdb7d3`\n- `Linux >= 58cfe9113e485f7e04bd0eac4fc4251b330af501 < 060db7d48af1e650643c8b8319111a9ea2ce4486`\n- `Linux >= 58cfe9113e485f7e04bd0eac4fc4251b330af501 < 2ef5560387f2c0713cee975be2b24b281bd90f3e`\n- `Linux >= 58cfe9113e485f7e04bd0eac4fc4251b330af501 < a72a13c83a652516a0e469d275b81d29a7429049`\n- `Linux >= 58cfe9113e485f7e04bd0eac4fc4251b330af501 < d762aef4eba354066be21a5d88eb2066e282f4c9`\n- `Linux >= 58cfe9113e485f7e04bd0eac4fc4251b330af501 < 885d802f544ca7bfa8f3984d94233cce715bb6b3`\n- `Linux 2.6.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}