Live › vulnerability › CVE-2026-98771
Go to dashboardThe Linux sierra_ms USB storage driver accepts a short device response and leaves part of a kernel heap buffer uninitialized. A malicious or emulated USB device can make that stale heap data readable by any local user through the world-readable truinst sysfs attribute.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the usb-storage sierra_ms driver built in or loaded, where a USB device with VID 0x1199 and PID 0x0fff can be attached. The sources do not say which kernel versions are affected, and they do not say whether a default configuration loads the driver. Systems that do not use this driver or cannot attach USB devices are unlikely to be exposed.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
usb: storage: sierra_ms: reject short SWoC info transfers
sierra_get_swoc_info() requests sizeof(struct swoc_info) (60) bytes from the device via usb_control_msg(), but its callers only treat a negative return value as failure. A device that answers the vendor-specific GetSwocInfo request with a short IN transfer is therefore accepted, leaving the tail of the freshly allocated (kmalloc(), non-zeroing) swoc_info buffer uninitialized.
truinst_show() subsequently prints swocInfo->rev, swocInfo->LinuxSKU and swocInfo->LinuxVer from that buffer into the world-readable (0444) "truinst" sysfs attribute. An emulated/malicious USB device (VID 0x1199, PID 0x0fff) can exploit this to disclose up to 5 bytes of stale kernel heap memory (kmalloc-64) to unprivileged userspace, once per sysfs read, indefinitely. On kernels built without init_on_alloc this leaks recently freed heap contents.
Only accept the transfer when the full structure was received. sierra_ms_init() already retries failed queries, so well-behaved devices are unaffected.
This page as .md · .json · in your agent: get_signal("CVE-2026-98771")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.