CVE-2026-98771: usb: storage: sierra_ms: reject short SWoC info transfers
In the Linux kernel, the following vulnerability has been resolved:
usb: storage: sierrams: reject short SWoC info transfers
sierragetswocinfo() requests sizeof(struct swocinfo) (60) bytes from the device via usbcontrolmsg(), but its callers only treat a negative return value as failure. A device that answers the vendor-specific GetSwocInfo request with a short IN transfer is therefore accepted, leaving the tail of the freshly allocated (kmalloc(), non-zeroing) swocinfo buffer uninitialized.
truinstshow() subsequently prints swocInfo->rev, swocInfo->LinuxSKU and swocInfo->LinuxVer from that buffer into the world-readable (0444) "truinst" sysfs attribute. An emulated/malicious USB device (VID 0x1199, PID 0x0fff) can exploit this to disclose up to 5 bytes of stale kernel heap memory (kmalloc-64) to unprivileged userspace, once per sysfs read, indefinitely. On kernels built without initonalloc this leaks recently freed heap contents.
Only accept the transfer when the full structure was received. sierramsinit() already retries failed queries, so well-behaved devices are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems that connect an emulated or malicious USB device presenting VID 0x1199 and PID 0x0fff are exposed. Once the device is accepted, unprivileged local users can read the world-readable "truinst" sysfs attribute and obtain leaked data.
What does an attacker need to exploit it?
An attacker needs control of a USB device, or an emulated USB device, that responds to the vendor-specific GetSwocInfo request with a deliberately short IN transfer. The disclosure can then be triggered repeatedly through reads of the relevant sysfs attribute.
Does kernel allocation hardening affect the impact?
The described stale heap disclosure occurs on kernels built without init_on_alloc, because the unreceived portion of the allocated buffer can contain recently freed data. The issue is still caused by accepting a short transfer; the fix requires the complete structure to be received.
What can be done before applying the fix?
Do not attach or permit untrusted USB devices that can present as VID 0x1199 and PID 0x0fff. Restricting unprivileged access to the affected world-readable sysfs attribute would also prevent those users from reading the disclosed bytes.