CVE-2026-90034: usb: image: mdc800: change kmalloc() to kzalloc()
In the Linux kernel, the following vulnerability has been resolved:
usb: image: mdc800: change kmalloc() to kzalloc()
Change the kmalloc() calls in usbmdc800init() for irqurbbuffer and downloadurbbuffer to kzalloc(), avoiding potential stack leaks if a shorter message is received in mdc800usbirq() and mdc800usbdownloadnotify()
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The vulnerable paths are in the mdc800 USB image driver, specifically its IRQ and download notification handlers. The issue can occur when a shorter USB message is received, leaving portions of buffers allocated by usb_mdc800_init() uninitialized.
What information could be exposed?
The description identifies potential leaks of uninitialized kernel memory through the affected buffers. It does not specify the exact data content, exposure channel, or attacker privileges required.
How can I determine whether my system has the fix?
Check whether your kernel includes one of the referenced stable commits: 6c601410d1a9ae645f604fe2f61b9f4942c77dfb, 2df8f7720ed91f1aad4f128553b6e90c7c5fac1e, or 67c6726dd6048a2781aa43a2bf9fcf1e16ee3a7d. The fix replaces the relevant kmalloc() allocations with kzalloc() in usb_mdc800_init().