Homepage

CVE-2026-80827 Affecting linux-6.12 package, versions <6.12.111-1~deb12u1

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.2% (10th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN12-LINUX612-20506504
  • published5 Oct 2026
  • disclosed4 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 4 Sep 2026

CVE-2026-80827  (opens in a new tab)

How to fix?

Upgrade Debian:12 linux-6.12 to version 6.12.111-1~deb12u1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream linux-6.12 package and not the linux-6.12 package as distributed by Debian. See How to fix? for Debian:12 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: option: fix slab OOB read in interrupt URB callback

The interrupt URB buffer is allocated in setup_port_interrupt_in() based on the endpoint's wMaxPacketSize:

buffer_size = usb_endpoint_maxp(epd);
port-&gt;interrupt_in_buffer = kmalloc(buffer_size, GFP_KERNEL);

When a USB device declares wMaxPacketSize = 8 on its interrupt IN endpoint, the buffer is allocated from kmalloc-8 cache (exactly 8 bytes).

If the device sends a short packet (actual_length < wMaxPacketSize), the URB completes with status == 0 and the callback proceeds to read:

data[sizeof(struct usb_ctrlrequest)]

which evaluates to data[8], accessing 1 byte beyond the allocated 8-byte buffer. This results in a slab out-of-bounds read.

Fix this by adding the missing bounds check: first verify that the actual length is large enough to contain the struct usb_ctrlrequest header before accessing req_pkt->bRequestType and req_pkt->bRequest, and then verify that there is an additional byte for the modem signal state before reading data[sizeof(struct usb_ctrlrequest)] inside the conditional. Use sizeof(*req_pkt) instead of sizeof(struct usb_ctrlrequest) for consistency.

[ johan: use dev_err(); split signals declaration and initialisation ]