Executive brief
The Linux kernel's USB serial option driver has a memory safety bug in its interrupt handler that processes USB device signals. A malicious or malfunctioning USB device can trigger a read of data beyond an allocated buffer, potentially exposing kernel memory. This could be exploited by an attacker with physical access to plug in a crafted USB device.
Technical details
This is a slab out-of-bounds read (CWE-125) in the option_instat_callback() function of drivers/usb/serial/option.c. The interrupt URB buffer is allocated based on the endpoint's wMaxPacketSize (e.g., 8 bytes), but the code unconditionally reads data[sizeof(struct usb_ctrlrequest)] (data[8]) without checking that the received packet is large enough. A USB device declaring wMaxPacketSize=8 can send a short packet, causing the callback to read 1 byte beyond the allocated buffer. The fix adds bounds checks: first verifying actual_length >= sizeof(*req_pkt) before accessing request fields, and second verifying actual_length >= sizeof(*req_pkt)+1 before reading the modem signal state byte. Attack vector is physical/adjacent (requires a USB device); no authentication required. The vulnerability dates back to v2.6.12 and has been patched.
Affected products
- Linux Linux kernel v2.6.12 and later (prior to fix)
Timeline
- 2026-09-04: disclosed: CVE-2026-80827 published
- 2026-09-02: patched: Patch merged by Greg Kroah-Hartman