The Linux kernel USBTMC driver handles optional interrupt endpoints for notification messages, which include two-byte headers indicating payload format. Prior to the fix, the driver did not verify that the URB actual_length was sufficient to contain these headers before accessing the data buffer. This could cause out-of-bounds reads or consumption of stale leftover data from previous notifications. The patch adds a check to ensure the actual_length is adequate; if not, the URB is resubmitted to the interrupt endpoint to prevent unsafe memory access.

This vulnerability can lead to out-of-bounds memory reads or use of stale data within the USBTMC driver in the Linux kernel. Such memory safety issues may cause kernel instability or potentially expose sensitive data. However, no known exploits in the wild have been reported, and the impact is limited to systems using USBTMC devices with interrupt-IN notifications.

A fix has been implemented in the Linux kernel to check the URB actual_length before accessing interrupt-IN notification headers. Users should apply the official kernel updates that include this patch to remediate the vulnerability. Since this is a kernel-level issue, updating the kernel to a version containing the fix is the recommended mitigation.