CVE-2026-80827

CVE CVE-2026-80827EUVD EUVD-2026-71277Published 2026-09-04T15:54:31.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: USB: serial: option: fix slab OOB read in interrupt URB callback The interrupt URB buffer is allocated in setup_port_interrupt_in() based on the endpoint's wMaxPacketSize: buffer_size = usb_endpoint_maxp(epd); port->interrupt_in_buffer = kmalloc(buffer_size, GFP_KERNEL); When a USB device declares wMaxPacketSize = 8 on its interrupt IN endpoint, the buffer is allocated from kmalloc-8 cache (exactly 8 bytes). If the device sends a short packet (actual_length < wMaxPacketSize), the URB completes with status == 0 and the callback proceeds to read: data[sizeof(struct usb_ctrlrequest)] which evaluates to data[8], accessing 1 byte beyond the allocated 8-byte buffer. This results in a slab out-of-bounds read. Fix this by adding the missing bounds check: first verify that the actual length is large enough to contain the struct usb_ctrlrequest header before accessing req_pkt->bRequestType and req_pkt->bRequest, and then verify that there is an additional byte for the modem signal state before reading data[sizeof(struct usb_ctrlrequest)] inside the conditional. Use sizeof(*req_pkt) instead of sizeof(struct usb_ctrlrequest) for consistency. [ johan: use dev_err(); split signals declaration and initialisation ]

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux patch: 7.3-rc1; 58cfe9113e485f7e04bd0eac4fc4251b330af501 <fbe60fd2abc8a5561f39719a41ad9a01b5d8e567; patch: 7.1.13; patch: 6.1.187; 58cfe9113e485f7e04bd0eac4fc4251b330af501 <6b8cf5422c7e96ed5b22a8368eff663f3f98b8ec; 2.6.12; patch: 6.18.49; patch: 7.2.3; 58cfe9113e485f7e04bd0eac4fc4251b330af501 <2ef5560387f2c0713cee975be2b24b281bd90f3e; patch: 0; 58cfe9113e485f7e04bd0eac4fc4251b330af501 <885d802f544ca7bfa8f3984d94233cce715bb6b3; 58cfe9113e485f7e04bd0eac4fc4251b330af501 <030e3a73d3c3aa67c44454649e984d6383cdb7d3; 58cfe9113e485f7e04bd0eac4fc4251b330af501 <94e5525697b9e91ddc4071129874120a50a4f342; patch: 6.6.156; 58cfe9113e485f7e04bd0eac4fc4251b330af501 <a72a13c83a652516a0e469d275b81d29a7429049; patch: 5.15.220; 58cfe9113e485f7e04bd0eac4fc4251b330af501 <060db7d48af1e650643c8b8319111a9ea2ce4486; patch: 6.12.108; patch: 5.10.269; 58cfe9113e485f7e04bd0eac4fc4251b330af501 <d762aef4eba354066be21a5d88eb2066e282f4c9

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.