CVE-2026-90034 usb: image: mdc800: change kmalloc() to kzalloc()
A local attacker with physical access can read uninitialized kernel memory via the mdc800 USB image driver due to missing buffer zeroing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90034?
CVE-2026-90034 is a vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: image: mdc800: change kmalloc() to kzalloc()
Change the kmalloc() calls in usb_mdc800_init() for irq_urb_buffer and download_urb_buffer to kzalloc(), avoiding potential stack leaks if a shorter message is received in mdc800_usb_irq() and mdc800_usb_download_notify()
Which versions are affected by CVE-2026-90034?
How do I fix CVE-2026-90034?
Apply the vendor's patch.
Is CVE-2026-90034 being exploited?
There is no known exploitation of CVE-2026-90034 in the wild and no public exploit code.
Sources
Also known as AZL-101322, BELL-CVE-2026-90034, DEBIAN-CVE-2026-90034, GHSA-cc2m-7vjr-3594, UBUNTU-CVE-2026-90034.