CVE-2026-98771 usb: storage: sierra_ms: reject short SWoC info transfers
A malicious USB device can leak stale kernel heap memory to unprivileged users via a sysfs attribute due to improper handling of short data transfers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-98771?
CVE-2026-98771 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: storage: sierra_ms: reject short SWoC info transfers
sierra_get_swoc_info() requests sizeof(struct swoc_info) (60) bytes from the device via usb_control_msg(), but its callers only treat a negative return value as failure. A device that answers the vendor-specific GetSwocInfo request with a short IN transfer is therefore accepted, leaving the tail of the freshly allocated (kmalloc(), non-zeroing) swoc_info buffer uninitialized.
truinst_show() subsequently prints swocInfo->rev, swocInfo->LinuxSKU and swocInfo->LinuxVer from that buffer into the world-readable (0444) "truinst" sysfs attribute. An emulated/malicious USB device (VID 0x1199, PID 0x0fff) can exploit this to disclose up to 5 bytes of stale kernel heap memory (kmalloc-64) to unprivileged userspace, once per sysfs read, indefinitely. On kernels built without init_on_alloc this leaks recently freed heap contents.
Only accept the transfer when the full structure was received. sierra_ms_init() already retries failed queries, so well-behaved devices are unaffected.
Which versions are affected by CVE-2026-98771?
How do I fix CVE-2026-98771?
Apply the vendor's patch.
Is CVE-2026-98771 being exploited?
There is no known exploitation of CVE-2026-98771 in the wild and no public exploit code.
Sources
Also known as AZL-109214, BELL-CVE-2026-98771, DEBIAN-CVE-2026-98771, GHSA-7hw4-87pj-mc7h, UBUNTU-CVE-2026-98771.