CVE-2026-80827

A flaw was found in the Linux kernel's USB serial option driver. A malicious USB device could exploit this vulnerability by sending a specially crafted short data packet. This could lead to an out-of-bounds read in memory, potentially allowing an attacker to access sensitive information or cause a denial of service.

This vulnerability is rated as Moderate impact because exploitation requires physical access to attach a rogue USB peripheral or an attacker controlling an emulated USB device inside a virtual machine. The flaw exists in the Linux kernel's option USB serial driver during the processing of interrupt packets from attached hardware. In standard enterprise deployments, USB modems utilizing this driver are not present on bare-metal servers or cloud instances, significantly limiting attack exposure. Successful exploitation can trigger a kernel panic resulting in a denial of service or potentially expose adjacent slab memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.