The Linux kernel USB serial driver for Belkin devices (belkin_sa) improperly handled interrupt-in buffer lengths by assuming a fixed four-byte status report. The actual interrupt data length is derived from the endpoint's wMaxPacketSize, but short interrupt transfers with smaller actual_length values were not validated before accessing status fields at offsets 2 and 3. This caused out-of-bounds or stale status-byte reads, as confirmed by a KASAN slab-out-of-bounds report in belkin_sa_read_int_callback. The vulnerability was addressed by adding checks on the completed interrupt packet length before parsing status fields, preventing invalid memory access.

This vulnerability could cause out-of-bounds memory reads in the kernel, potentially leading to kernel crashes or information disclosure. However, no known exploits in the wild have been reported. The impact is limited to systems using the affected USB serial driver for Belkin devices.

A fix has been implemented in the Linux kernel to validate interrupt packet lengths before parsing status fields in the belkin_sa driver. Since this is a kernel vulnerability, applying the official Linux kernel updates that include this fix is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult the Linux kernel vendor advisory or update channels for the official fix.