PT-2026-64560 · Linux · Linux
CVE-2026-64339
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
usb: misc: usbio: bound bulk IN response length to the received transfer
usbio bulk msg() copies bpkt len = le16 to cpu(bpkt->len) bytes out of
the bulk IN buffer (usbio->rxbuf, allocated with size usbio->rxbuf len)
into the caller's buffer. bpkt len is fully controlled by the device
and is only checked against ibuf len; ibuf len in turn is checked
against usbio->txbuf len, not against rxbuf len:
if ((obuf len > (usbio->txbuf len - sizeof(*bpkt))) ||
(ibuf len > (usbio->txbuf len - sizeof(*bpkt))))
return -EMSGSIZE;txbuf len and rxbuf len are taken independently from the bulk OUT and
bulk IN endpoint wMaxPacketSize in usbio probe(). A malicious or
malfunctioning device that advertises a large bulk OUT endpoint and a
small bulk IN endpoint (e.g. by claiming one of the quirk-free IDs such
as the Lattice NX33U, 0x2ac1:0x20cb) therefore makes ibuf len, and
hence the device-supplied bpkt len, exceed rxbuf len. memcpy() then
reads up to txbuf len - rxbuf len bytes past the end of the rxbuf slab
object. The over-read bytes are handed back to the i2c layer and on to
user space through i2c-dev, disclosing adjacent slab memory; with KASAN
this is reported as a slab-out-of-bounds read.
The number of bytes actually received is already known: act equals the
URB actual length and is bounded by rxbuf len. Reject any response
that claims more payload than was received, mirroring the existing
"act < sizeof(*bpkt)" check just above.
The control path (usbio ctrl msg()) is not affected: it uses a single
buffer (ctrlbuf) for both directions, so its analogous copy can never
leave the allocation.
Found by code review. The out-of-bounds read was confirmed under
AddressSanitizer with a faithful userspace model of usbio bulk msg()'s
receive path (an rxbuf len-sized buffer, the same act/ibuf len/bpkt len
checks and the memcpy). A USB raw-gadget + dummy hcd reproducer is
also available.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux