CVE-2026-80827: Linux Kernel USB Serial Buffer Overflow

CVE-2026-80827 Overview

CVE-2026-80827 is a slab out-of-bounds read vulnerability in the Linux kernel's USB serial option driver. The flaw resides in the interrupt URB (USB Request Block) completion callback within drivers/usb/serial/option.c. When a USB device declares wMaxPacketSize = 8 on its interrupt IN endpoint, the driver allocates an 8-byte buffer from the kmalloc-8 slab cache. The callback then reads data[sizeof(struct usb_ctrlrequest)], which evaluates to data[8] and accesses one byte beyond the allocation. A malicious or malformed USB device sending a short packet can trigger the out-of-bounds read.

Critical Impact
A crafted USB device can trigger a 1-byte slab out-of-bounds read in the kernel, enabling potential kernel memory disclosure or triggering KASAN-detected instability on affected Linux systems.

Affected Products

Linux kernel USB serial option driver (drivers/usb/serial/option.c)
Linux distributions shipping vulnerable kernel versions prior to the fix commits
Systems supporting USB modem devices handled by the option driver

Discovery Timeline

2026-09-04 - CVE-2026-80827 published to the National Vulnerability Database
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80827

Vulnerability Analysis

The vulnerability is an [CWE-125] out-of-bounds read in the interrupt URB callback of the USB serial option driver. The driver allocates interrupt_in_buffer in setup_port_interrupt_in() using the endpoint's wMaxPacketSize value returned by usb_endpoint_maxp(epd). When the device reports a wMaxPacketSize of 8, kmalloc() returns exactly 8 bytes from the kmalloc-8 slab cache.

Upon URB completion with status 0, the callback processes the received buffer as a struct usb_ctrlrequest header followed by additional payload bytes. The code accesses data[sizeof(struct usb_ctrlrequest)] to read the modem signal state. Because sizeof(struct usb_ctrlrequest) equals 8, this read touches offset 8 in an 8-byte allocation, exceeding the buffer by one byte. The overrun leaks adjacent slab data into kernel processing paths and can be flagged by KASAN as a slab-out-of-bounds report.

Root Cause

The root cause is a missing bounds check on the URB actual_length before dereferencing beyond the usb_ctrlrequest header. The callback assumes that any completed short packet contains both a valid header and the trailing signal state byte, without verifying that the device actually transmitted enough bytes to justify the access.

Attack Vector

Exploitation requires physical or logical access to attach a USB device that the option driver binds to. The malicious device advertises an interrupt IN endpoint with wMaxPacketSize = 8, then emits a short packet during interrupt polling. The vulnerable callback reads one byte past the slab allocation, producing an out-of-bounds read that can disclose adjacent kernel heap content or destabilize systems compiled with memory sanitizers.

No verified public exploit code is available. The vulnerability mechanism is described in the upstream patch series referenced in the Linux Kernel Commit.

Detection Methods for CVE-2026-80827

Indicators of Compromise

KASAN reports in dmesg identifying slab-out-of-bounds reads originating in the USB serial option driver's interrupt completion path
Unexpected connection of USB devices matching the option driver's device ID table on production hosts
Kernel warnings referencing interrupt_in_buffer or the option module during URB completion

Detection Strategies

Enable KASAN in test and staging kernels to surface the exact out-of-bounds read at runtime
Correlate USB device connection events from udev and kernel logs with subsequent driver faults tied to the option module
Audit loaded kernel modules on endpoints to identify systems where the option driver is present and reachable

Monitoring Recommendations

Forward kernel ring buffer and journald logs to a centralized data lake to detect KASAN and USB driver anomalies
Alert on new USB serial device enumeration events on servers and workstations that do not normally use cellular modems
Track kernel version inventory to identify hosts running unpatched builds of drivers/usb/serial/option.c

How to Mitigate CVE-2026-80827

Immediate Actions Required

Update to a Linux kernel version containing the upstream fix that adds bounds checks against sizeof(*req_pkt) before dereferencing the URB buffer
Restrict physical USB port access on high-value systems and enforce USB device allow-listing where feasible
Unload or blacklist the option kernel module on systems that do not require USB cellular modem support

Patch Information

The upstream fix adds explicit checks that the URB actual_length is large enough to contain a struct usb_ctrlrequest header before reading bRequestType and bRequest, and that an additional byte is present before reading data[sizeof(*req_pkt)]. Backport commits are available across stable branches, including 030e3a73d3c3, 060db7d48af1, 2ef5560387f2, 6b8cf5422c7e, 885d802f544c, 94e5525697b9, a72a13c83a65, d762aef4eba3, and fbe60fd2abc8.

Workarounds

Blacklist the option module in /etc/modprobe.d/ on systems that do not require USB modem functionality
Enforce USB device policy through usbguard or equivalent to prevent unauthorized USB serial devices from binding to the driver
Disable unused USB controllers in BIOS or firmware on servers where USB peripherals are not required

bash

# Blacklist the vulnerable option driver until patched kernels are deployed
echo 'blacklist option' | sudo tee /etc/modprobe.d/blacklist-option.conf
sudo modprobe -r option 2>/dev/null || true
sudo update-initramfs -u