A missing sanity check on the size of interrupt-in transfers in the Linux USB serial driver (mct_u232) allowed the driver to parse stale or uninitialised slab data. This could cause sensitive information to be copied from kernel memory into user space, leading to an information‑disclosure vulnerability. The weakness is consistent with an unvalidated read of uninitialised memory, a common information‑exposure flaw.

The vulnerability affected all Linux kernel builds that include the mct_u232 driver before the patch was applied. No specific kernel release information is provided in the advisory, so any kernel version built with the unpatched driver is potentially impacted. The affected product is the Linux kernel’s USB serial subsystem.

The EPSS score is reported as < 1 %, indicating a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Because the flaw requires the driver to process an interrupt‑in transfer, an attacker would need to supply a specially crafted USB device or otherwise trigger the driver to read from the stale buffer. The attack vector is therefore likely local or through a compromised USB‑connected device. The impact is limited to revealing data that was present in kernel memory at the time of the fault, rather than granting arbitrary code execution or privilege escalation.