CVE-2026-80827

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: option: fix slab OOB read in interrupt URB callback

The interrupt URB buffer is allocated in setup_port_interrupt_in() based

on the endpoint's wMaxPacketSize:

buffer_size = usb_endpoint_maxp(epd);

port->interrupt_in_buffer = kmalloc(buffer_size, GFP_KERNEL);

When a USB device declares wMaxPacketSize = 8 on its interrupt IN

endpoint, the buffer is allocated from kmalloc-8 cache (exactly

8 bytes).

If the device sends a short packet (actual_length < wMaxPacketSize),

the URB completes with status == 0 and the callback proceeds to read:

data[sizeof(struct usb_ctrlrequest)]

which evaluates to data[8], accessing 1 byte beyond the allocated 8-byte

buffer. This results in a slab out-of-bounds read.

Fix this by adding the missing bounds check: first verify that the

actual length is large enough to contain the struct usb_ctrlrequest

header before accessing req_pkt->bRequestType and req_pkt->bRequest,

and then verify that there is an additional byte for the modem signal

state before reading data[sizeof(struct usb_ctrlrequest)] inside the

conditional. Use sizeof(*req_pkt) instead of sizeof(struct

usb_ctrlrequest) for consistency.

[ johan: use dev_err(); split signals declaration and initialisation ]