The Linux kernel contained a vulnerability in the USB serial driver for cypress_m8 devices where the interrupt-out endpoint's maximum packet size was not properly validated. If a malicious USB device reported a max packet size smaller than eight bytes, it could cause user-controlled slab memory corruption or a NULL-pointer dereference. The fix enforces a minimum packet size of eight bytes to prevent this memory corruption.

Exploitation of this vulnerability could allow a malicious USB device to cause memory corruption or trigger a NULL-pointer dereference in the kernel, potentially leading to system instability or denial of service. There is no indication of code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to enforce a minimum interrupt-out endpoint max packet size of eight bytes for the cypress_m8 USB serial driver. Users should update their Linux kernel to a version that includes this fix. Patch status is not explicitly confirmed in the provided data; users should consult the official Linux kernel advisories or vendor updates for the exact fixed versions and apply updates accordingly.