usb: usbtmc: check URB actual_length for interrupt-IN notifications

Summary

In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: check URB actual_length for interrupt-IN notifications USBTMC devices can use an optional interrupt endpoint for notification messages. These typically contain two-byte headers indicating the payload format, but the driver does not check if these headers are present before accessing the data buffers. In cases where the URB actual_length is not enough to fit these headers, the driver will either cause an out-of-bounds read, or consume stale leftover data from a previous notification. Fix by checking if actual_data contains enough bytes for the headers, otherwise resubmit URB to the interrupt endpoint.

Timeline

1. Jul 19, 2026, 2:55 PM UTCCVE published

Affected versions

• Linux Linux

  Version range not reported

• Linux Linux

  4.6

References 8