Executive brief
A vulnerability was identified in the Linux kernel's USB Test and Measurement Class (USBTMC) driver. This driver is used to communicate with specialized laboratory equipment like oscilloscopes and signal generators via USB. An attacker with physical access or control over a connected USB device could trigger an out-of-bounds memory read, potentially leading to system instability or the exposure of sensitive kernel data.
Technical details
The vulnerability exists in the usbtmc_interrupt function within drivers/usb/class/usbtmc.c. USBTMC devices use an optional interrupt endpoint for notification messages that typically include a two-byte header. The driver fails to verify if the USB Request Block (URB) actual_length is at least two bytes before accessing the iin_buffer. An attacker providing a malformed USB packet with a length of less than 2 bytes can trigger an out-of-bounds read or cause the driver to process stale data from previous notifications. This issue was discovered via syzbot and has been patched in multiple stable kernel branches by adding a length check and resubmitting the URB if the header is insufficient.
Affected products
- Linux Linux 4.6 to 5.10.259, 5.15.161, 6.1.94, 6.6.34, 6.9.5
Timeline
- 2026-05-05: other: Patch authored
- 2026-05-22: patched: Patch committed to stable tree
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/52f2ad3f7e5eb3b5908e1d685d4342519dc9cfcd
- https://git.kernel.org/stable/c/5de7df75ef3a2756b25fe3d582a4a2970444fe5a
- https://git.kernel.org/stable/c/69020fa089f1bf0e1a10a15265f31b143a846409
- https://git.kernel.org/stable/c/75f6d3da2cc646983f41807ef98851569c12bca9
- https://git.kernel.org/stable/c/ae87f505917e703ae3b487d9663d78826ff43608
- https://git.kernel.org/stable/c/e3eec3005de44e7f37d8d7724be636446516ab42
- https://git.kernel.org/stable/c/e794bd67b3faf98af46f958897f6b91412c7d2a9