The Linux kernel's cypress_m8 USB serial driver had a vulnerability in the cypress_read_int_callback() function where interrupt-in buffers were parsed without sufficient validation of the packet headers. Format 1 packets have a two-byte status/count header, and format 2 packets have a one-byte combined header. The usb-serial core sizes the buffer based on the endpoint descriptor's wMaxPacketSize, but successful interrupt transfers could complete short if URB_SHORT_NOT_OK was not set, leading to potential out-of-bounds reads. The patch added checks to verify the presence of the expected header before reading, ignoring malformed short reports and resubmitting the interrupt URB to avoid slab-out-of-bounds errors detected by KASAN.

This vulnerability could cause out-of-bounds memory reads in the kernel when processing malformed USB interrupt packets from Cypress M8 serial devices. Such memory errors can lead to kernel instability or crashes. There is no indication of known exploits in the wild or direct privilege escalation or code execution impact from the provided data.

A fix has been applied in the Linux kernel to validate interrupt packet headers in the cypress_m8 USB serial driver, preventing out-of-bounds reads. Users should update to a Linux kernel version that includes this patch. Since no specific patched versions are provided, check the vendor or kernel mailing lists for the exact fixed version. No additional mitigation is indicated.