The Linux kernel's HID driver for MCP2221 devices contained a flaw where mcp2221_raw_event() trusted the device-supplied data length without verifying that the reported size matched the actual received report size. Specifically, in the MCP2221_I2C_GET_DATA path, the function used data[3] as the copy length without confirming that 4 + data[3] bytes were present. A malicious or malfunctioning USB device could exploit this by sending a short report with a large data[3] value, causing memcpy to read beyond the valid buffer and leak uninitialized kernel memory to userspace through the I2C/SMBus interface. The vulnerability was addressed by adding checks to ensure the source range fits within the received report before copying.

This vulnerability allows a malicious USB device to cause the kernel to leak uninitialized memory contents to userspace. This memory disclosure could potentially expose sensitive kernel memory contents, which may aid further attacks or information gathering. There is no indication of code execution or privilege escalation from the provided data.

A fix has been applied to the Linux kernel to validate HID report sizes in mcp2221_raw_event(). Users should update to a kernel version that includes this patch. No additional mitigation is indicated or required beyond applying the official fix.