CVE-2026-98771

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: storage: sierra_ms: reject short SWoC info transfers

sierra_get_swoc_info() requests sizeof(struct swoc_info) (60) bytes

from the device via usb_control_msg(), but its callers only treat a

negative return value as failure. A device that answers the

vendor-specific GetSwocInfo request with a short IN transfer is

therefore accepted, leaving the tail of the freshly allocated

(kmalloc(), non-zeroing) swoc_info buffer uninitialized.

truinst_show() subsequently prints swocInfo->rev, swocInfo->LinuxSKU

and swocInfo->LinuxVer from that buffer into the world-readable

(0444) "truinst" sysfs attribute. An emulated/malicious USB device

(VID 0x1199, PID 0x0fff) can exploit this to disclose up to 5 bytes

of stale kernel heap memory (kmalloc-64) to unprivileged userspace,

once per sysfs read, indefinitely. On kernels built without

init_on_alloc this leaks recently freed heap contents.

Only accept the transfer when the full s

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References