CVE-2026-64339

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the usbio bulk msg() function. The function copies bpkt len bytes from the bulk IN buffer usbio->rxbuf into the caller's buffer. However, bpkt len is controlled by the USB device and is validated against ibuf len, which is checked against usbio->txbuf len instead of the actual receive buffer size usbio->rxbuf len. A malicious or malfunctioning device that advertises a large bulk OUT endpoint and a small bulk IN endpoint can cause bpkt len to exceed usbio->rxbuf len. This allows memcpy() to read past the end of the rxbuf slab object, potentially disclosing adjacent slab memory to user space through i2c-dev. A slab-out-of-bounds read occurs when the system reads memory outside the allocated boundary of a slab object.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.