Executive brief
The Linux kernel's MCP2221 USB-to-I2C bridge driver fails to validate incoming HID report sizes, allowing a malicious or malfunctioning USB device to trigger a buffer over-read. An attacker with a crafted USB device can leak uninitialized kernel memory to userspace, potentially exposing sensitive data such as cryptographic keys or other secrets stored in kernel memory.
Technical details
The vulnerability is a missing input validation (CWE-119/buffer over-read) in the mcp2221_raw_event() HID event handler. The function trusts a device-supplied data[3] byte as a memcpy length without verifying that 4 + data[3] bytes actually exist in the received report buffer. A malicious USB device can send a short HID report with a large data[3] value, causing memcpy to read past the valid report data in the HID transfer buffer and leak uninitialized kernel memory back to userspace through the I2C/SMBus read data path. Attack requires physical access or a rogue USB device on the bus; no authentication or special privileges are needed. The patch adds a minimum size check (size < 4) at entry and validates 4 + data[3] <= size before the copy operation.
Affected products
- Linux Linux kernel 4.9+
Timeline
- 2026-09-11: disclosed
- 2026-08-03: patched: upstream fix merged
- 2026-09-07: patched: stable kernel backport