Executive brief
The Intel USBIO bridge driver in the Linux kernel contains a logic error in its bulk message validation code that compares the receive buffer size against the wrong endpoint parameter. This could allow oversized receive requests to bypass the safety check and potentially cause buffer overflows, leading to kernel crashes or data corruption.
Technical details
The vulnerability is a logic error in the usbio_bulk_msg() function in drivers/usb/misc/usbio.c. The EMSGSIZE validation check for the incoming (bulk IN) buffer size compares ibuf_len against txbuf_len (the transmit endpoint buffer size) instead of rxbuf_len (the receive endpoint buffer size). Since these parameters are obtained independently from different USB endpoints during device probe, the comparison is incorrect when buffer sizes differ. An attacker could bypass the size check by triggering a bulk message with an ibuf_len that exceeds the actual rxbuf_len allocation, potentially causing a buffer overflow. The fix changes line 268 to compare ibuf_len against rxbuf_len. No evidence of active exploitation has been reported.
Affected products
- Linux Linux kernel All versions with Intel USBIO driver (introduced in commit 121a0f839dbb)
Timeline
- 2026-08-22: disclosed
- 2026-08-03: patched: Fix committed upstream and backported to stable branches