CVE-2026-98771
Received Received - Intake

Heap Memory Disclosure in Linux Kernel USB Storage Driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usb: storage: sierra_ms: reject short SWoC info transfers sierra_get_swoc_info() requests sizeof(struct swoc_info) (60) bytes from the device via usb_control_msg(), but its callers only treat a negative return value as failure. A device that answers the vendor-specific GetSwocInfo request with a short IN transfer is therefore accepted, leaving the tail of the freshly allocated (kmalloc(), non-zeroing) swoc_info buffer uninitialized. truinst_show() subsequently prints swocInfo->rev, swocInfo->LinuxSKU and swocInfo->LinuxVer from that buffer into the world-readable (0444) "truinst" sysfs attribute. An emulated/malicious USB device (VID 0x1199, PID 0x0fff) can exploit this to disclose up to 5 bytes of stale kernel heap memory (kmalloc-64) to unprivileged userspace, once per sysfs read, indefinitely. On kernels built without init_on_alloc this leaks recently freed heap contents. Only accept the transfer when the full structure was received. sierra_ms_init() already retries failed queries, so well-behaved devices are unaffected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98771
EUVD
EUVD-2026-103856

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 32fe5e393455d87db4988af03915634304870fb4
Linux Linux 32fe5e393455d87db4988af03915634304870fb4
Linux Linux 32fe5e393455d87db4988af03915634304870fb4
Linux Linux 32fe5e393455d87db4988af03915634304870fb4
Linux Linux 2.6.27

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a USB storage driver (sierra_ms) that fails to validate the length of data received from a device. When querying device info, it requests 60 bytes but only checks for negative errors, accepting short transfers. This leaves part of a kernel memory buffer uninitialized. Later, when printing device info to a sysfs file, it exposes up to 5 bytes of stale heap memory to unprivileged users.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB storage driver (sierra_ms). Detection requires checking kernel logs for unusual USB device interactions or sysfs attribute reads. Monitor for devices with VID 0x1199 and PID 0x0fff. Inspect sysfs entries under /sys/devices/ for 'truinst' attributes.

Impact Analysis

An attacker with physical access could plug in a malicious USB device to exploit this flaw. This could allow them to read small amounts of sensitive kernel memory, potentially exposing sensitive data like passwords or encryption keys. The impact is limited to information disclosure and requires physical access to the system.

Compliance Impact

This vulnerability could impact compliance by potentially exposing sensitive data, which may violate GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Organizations must ensure systems are patched to prevent unauthorized memory disclosure that could lead to data breaches.

Mitigation Strategies

Apply the latest Linux kernel updates to patch this issue. If immediate patching is not possible, disable the sierra_ms module using 'modprobe -r sierra_ms' and block the affected USB device IDs (0x1199:0x0fff) via udev rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98771. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart