Out-of-Bounds Read Vulnerability in Linux Kernel USB Serial Component

CVE-2026-80827

What is CVE-2026-80827?

A vulnerability has been identified in the USB serial component of the Linux kernel, wherein a slab out-of-bounds read may occur due to improper handling of buffer sizes. Specifically, when a USB device indicates a maximum packet size of 8 bytes for its interrupt IN endpoint, a buffer of the same size is allocated. If the device transmits a packet smaller than this size, the callback erroneously attempts to access memory beyond the allocated buffer, leading to potential memory disclose issues. A fix has been implemented to validate the actual length of the packet before attempting to read beyond the buffer's boundary, thereby mitigating the risk of exploitation.

References