{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.187-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.13-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  USB: serial: option: fix slab OOB read in interrupt URB callback  The interrupt URB buffer is allocated in setup_port_interrupt_in() based on the endpoint's wMaxPacketSize:      buffer_size = usb_endpoint_maxp(epd);     port-\u003einterrupt_in_buffer = kmalloc(buffer_size, GFP_KERNEL);  When a USB device declares wMaxPacketSize = 8 on its interrupt IN endpoint, the buffer is allocated from kmalloc-8 cache (exactly 8 bytes).  If the device sends a short packet (actual_length \u003c wMaxPacketSize), the URB completes with status == 0 and the callback proceeds to read:      data[sizeof(struct usb_ctrlrequest)]  which evaluates to data[8], accessing 1 byte beyond the allocated 8-byte buffer. This results in a slab out-of-bounds read.  Fix this by adding the missing bounds check: first verify that the actual length is large enough to contain the struct usb_ctrlrequest header before accessing req_pkt-\u003ebRequestType and req_pkt-\u003ebRequest, and then verify that there is an additional byte for the modem signal state before reading data[sizeof(struct usb_ctrlrequest)] inside the conditional.  Use sizeof(*req_pkt) instead of sizeof(struct usb_ctrlrequest) for consistency.  [ johan: use dev_err(); split signals declaration and initialisation ]",
  "id": "DEBIAN-CVE-2026-80827",
  "modified": "2026-09-14T16:47:46.133896951Z",
  "published": "2026-09-04T16:18:10.683Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-80827"
    }
  ],
  "upstream": [
    "CVE-2026-80827"
  ]
}