The cypress_m8 USB serial driver in the Linux kernel failed to verify that the interrupt‑out endpoint maximum packet size was at least eight bytes. If a device reports a smaller size, the driver writes outside the bounds of its allocated buffer, leading to user‑controlled slab corruption or a NULL‑pointer dereference in kernel space. The text does not mention arbitrary code execution or privilege escalation, so the impact is limited to memory corruption, kernel instability, and potential service interruption.

The flaw exists in any Linux kernel configuration that includes and loads the cypress_m8 USB serial driver. No specific kernel version range is cited, but the patch was committed to upstream kernel source and will appear in releases that incorporate that change.

The CVSS score of 7.0 indicates a moderate severity, while the EPSS score of <1% shows a very low exploitation probability. The vulnerability is not listed in CISA KEV. Based on typical USB driver operation, the likely attack vector involves a malicious USB device physically connected to the target system that reports an unusually small endpoint size. This is a local, physical attack, as no network or remote exploits are described. While exploitation could cause kernel crashes or corruption, there is no public evidence of a remote or automated exploit.