CVE-2026-46167: usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
In the Linux kernel, the following vulnerability has been resolved:
usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
Just like in a previous problem in this driver, usblpctrlmsg() will collapse the usbcontrolmsg() return value to 0/-errno, discarding the actual number of bytes transferred.
Ideally that short command should be detected and error out, but many printers are known to send "incorrect" responses back so we can't just do that.
statusbuf is kmalloc(8) at probe time and never filled before the first LPGETSTATUS ioctl.
usblpreadstatus() requests 1 byte. If a malicious printer responds with zero bytes, statusbuf is one byte of stale kmalloc heap, sign-extended into the local int status, which the LPGETSTATUS path then copytouser()s directly to the ioctl caller.
Fix this all by just zapping out the memory buffer when allocated at probe time. If a later call does a short read, the data will be identical to what the device sent it the last time, so there is no "leak" of information happening.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Configuration
Apply the resolved fix in the Linux kernel for the usblp uninitialized heap leak via the LPGETSTATUS ioctl so that statusbuf is not left uninitialized (do not copy stale kmalloc heap contents to the ioctl caller; collapse usb_control_msg() return to 0/-errno and discard the number-of-bytes-transferred value as described).
Linux kernel usblp driver (LPGETSTATUS ioctl) statusbuf initialization before copy_to_user() = Initialize statusbuf (avoid copying uninitialized kmalloc(8) contents to user; ensure correct bytes returned by usb_control_msg are used)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46167?
The severity of CVE-2026-46167 is rated at 15.
What type of vulnerability is CVE-2026-46167?
CVE-2026-46167 is a heap leak vulnerability in the usblp driver of the Linux kernel.
How do I fix CVE-2026-46167?
To fix CVE-2026-46167, ensure that you update the Linux kernel to a patched version that addresses this vulnerability.
Which software is affected by CVE-2026-46167?
CVE-2026-46167 affects the Linux kernel, specifically the usblp driver.
Can CVE-2026-46167 lead to data exposure?
Yes, CVE-2026-46167 can potentially lead to data exposure due to uninitialized heap leaks.