During interrupt‑in packet handling the Cypress cypress_m8 USB serial driver assumes a header is present and reads the first byte of the buffer without a bounds check. This omission can lead to a one‑byte read past the buffer boundaries, exposing kernel memory to an attacker. The flaw is a classic out‑of‑bounds read identified as CWE‑125 and could be leveraged to leak sensitive data or to assist higher‑level attacks such as privilege escalation.

All Linux kernel releases that ship the cypress_m8 driver and have not yet incorporated the patch that validates the packet header. This includes stock Linux kernels distributed by major vendors for systems that use Cypress USB serial controllers. Any device that matches the Cypress chip set and relies on the default driver is potentially affected unless the kernel has been updated past the commit that adds a header‑validation check.

The EPSS score is below 1 %, indicating a very small expected exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.5 reflects moderate severity: the flaw permits a narrow memory read but does not directly grant code execution. Based on the description, the likely attack vector is a malicious USB device that sends crafted interrupt‑in packets to trigger the out‑of‑bounds read; this inference is drawn from the mention of malformed short reports and the reliance on a USB interrupt‑in buffer. Consequently, an attacker must have physical access to the host. No public exploits have been reported.