CVE-2026-64339: Linux Kernel Information Disclosure Flaw

CVE-2026-64339 Overview

CVE-2026-64339 is an out-of-bounds read vulnerability in the Linux kernel's usb: misc: usbio driver. The flaw resides in usbio_bulk_msg(), which copies a device-controlled length (bpkt_len) from the bulk IN buffer into the caller's buffer without validating that length against the actual receive buffer size (rxbuf_len). A malicious or malfunctioning USB device that advertises a large bulk OUT endpoint and a small bulk IN endpoint can trigger a memcpy() that reads past the end of the rxbuf slab object. The over-read data is returned through the i2c layer to userspace via i2c-dev, disclosing adjacent kernel slab memory.

Critical Impact
A crafted USB device can force the kernel to leak adjacent slab memory to userspace through the i2c-dev interface, enabling kernel information disclosure.

Affected Products

Linux kernel versions containing the usb: misc: usbio driver prior to the fixing commits
Systems exposing i2c-dev to userspace over usbio-backed adapters
Hosts accepting USB devices with quirk-free IDs such as Lattice NX33U (0x2ac1:0x20cb)

Discovery Timeline

2026-07-25 - CVE-2026-64339 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64339

Vulnerability Analysis

The vulnerability lives in usbio_bulk_msg() in the Linux kernel usbio misc driver. The function copies bpkt_len = le16_to_cpu(bpkt->len) bytes from usbio->rxbuf into a caller-supplied buffer. bpkt_len is entirely device-controlled and is only bounded against ibuf_len, which itself is validated against usbio->txbuf_len rather than rxbuf_len.

Because txbuf_len and rxbuf_len are derived independently from the bulk OUT and bulk IN endpoint wMaxPacketSize values in usbio_probe(), a device can advertise a large OUT endpoint and a small IN endpoint. The mismatch allows bpkt_len to exceed the actual rxbuf allocation, and the resulting memcpy() reads up to txbuf_len - rxbuf_len bytes past the slab object.

Root Cause

The check (ibuf_len > (usbio->txbuf_len - sizeof(*bpkt))) validates the requested response size against the transmit buffer allocation rather than the receive buffer. This is an [Out-of-Bounds Read] caused by improper input validation of a device-supplied length field.

Attack Vector

An attacker with physical USB access, or an already-compromised USB device, can present descriptors advertising asymmetric bulk endpoint sizes. When the host issues a bulk IN transfer, the returned packet header claims a bpkt_len larger than rxbuf_len. The over-read bytes flow through the i2c layer into userspace via i2c-dev, leaking adjacent slab contents. KASAN reports this as a slab-out-of-bounds read. The control path usbio_ctrl_msg() is unaffected because it uses a single shared ctrlbuf for both directions.

Detection Methods for CVE-2026-64339

Indicators of Compromise

KASAN reports flagging slab-out-of-bounds reads originating from usbio_bulk_msg() in kernel logs
Unexpected USB device enumeration with mismatched bulk OUT and bulk IN wMaxPacketSize values
Anomalous i2c-dev read activity returning larger-than-expected payloads to userspace

Detection Strategies

Enable KASAN on test and staging kernels to surface out-of-bounds reads in the usbio driver during fuzzing or hardware evaluation
Audit kernel dmesg output for warnings referencing usbio, rxbuf, or i2c bulk transfer errors
Monitor for connections of USB devices matching IDs handled by the usbio driver, including 0x2ac1:0x20cb (Lattice NX33U)

Monitoring Recommendations

Collect and forward kernel logs to a centralized log platform for pattern matching on usbio driver messages
Track USB device attach events with vendor and product ID plus endpoint descriptor metadata
Alert on repeated i2c-dev reads returning unexpectedly large buffers from usbio-backed adapters

How to Mitigate CVE-2026-64339

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits 48394f94, 8c6314489550, and fc1b546973c1
Rebuild and redeploy any custom kernels that include the usb: misc: usbio driver
Restrict physical USB access on systems that expose i2c-dev to unprivileged users

Patch Information

The fix rejects any bulk IN response that claims more payload than was actually received, mirroring the existing act < sizeof(*bpkt) check. Because act is bounded by rxbuf_len via the URB actual_length, comparing bpkt_len against act prevents the over-read. Patches are available in the following stable tree commits: Kernel Git Commit 48394f94, Kernel Git Commit 8c6314489550, and Kernel Git Commit fc1b546973c1.

Workarounds

Blacklist the usbio kernel module on systems that do not require Intel USBIO bridge functionality
Use USB port access controls or udev rules to block unknown USB devices from binding to the usbio driver
Remove or restrict i2c-dev access so that leaked bytes cannot be read back by unprivileged userspace

bash

# Blacklist the usbio module to prevent it from loading
echo 'blacklist usbio' | sudo tee /etc/modprobe.d/blacklist-usbio.conf
sudo update-initramfs -u