The Linux kernel usbio_bulk_msg() function improperly bounds the bulk IN response length by comparing the device-controlled length against the bulk OUT buffer size rather than the bulk IN buffer size. This mismatch allows a malicious or malfunctioning USB device to cause a slab out-of-bounds read by advertising a large bulk OUT endpoint and a small bulk IN endpoint, leading to a memcpy() reading beyond the allocated bulk IN buffer. The vulnerability was identified through code review and confirmed with AddressSanitizer and a USB raw-gadget reproducer. The control path usbio_ctrl_msg() is unaffected due to its use of a single buffer for both directions. The fix involves rejecting any response claiming more payload than was actually received, mirroring existing checks.

An attacker controlling a malicious USB device can cause the kernel to read beyond the allocated bulk IN buffer, potentially disclosing adjacent kernel slab memory to user space via the i2c-dev interface. This out-of-bounds read could lead to information disclosure of kernel memory contents. There is no indication of code execution or privilege escalation from this vulnerability. The control path is unaffected, limiting the scope to information disclosure via out-of-bounds reads.

A fix has been implemented in the Linux kernel to reject any bulk IN response claiming more payload than was actually received, preventing the out-of-bounds read. Users should update their Linux kernel to a version that includes this fix. Since this is a kernel-level vulnerability, applying the official kernel patch or upgrading to a fixed kernel version is the recommended mitigation. No additional mitigations are indicated by the vendor advisory.