CVE-2026-80827

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: option: fix slab OOB read in interrupt URB callback

The interrupt URB buffer is allocated in setup port interrupt in() based on the endpoint's wMaxPacketSize:

buffer size = usb endpoint maxp(epd); port->interrupt in buffer = kmalloc(buffer size, GFP KERNEL);

When a USB device declares wMaxPacketSize = 8 on its interrupt IN endpoint, the buffer is allocated from kmalloc-8 cache (exactly 8 bytes).

If the device sends a short packet (actual length < wMaxPacketSize), the URB completes with status == 0 and the callback proceeds to read:

data[sizeof(struct usb ctrlrequest)]

which evaluates to data[8], accessing 1 byte beyond the allocated 8-byte buffer. This results in a slab out-of-bounds read.

Fix this by adding the missing bounds check: first verify that the actual length is large enough to contain the struct usb ctrlrequest header before accessing req pkt->bRequestType and req pkt->bRequest, and then verify that there is an additional byte for the modem signal state before reading data[sizeof(struct usb ctrlrequest)] inside the conditional. Use sizeof(*req pkt) instead of sizeof(struct usb ctrlrequest) for consistency.

[ johan: use dev err(); split signals declaration and initialisation ]