{"id":"CVE-2026-98771","kind":"vulnerability","aliases":["CVE-2026-98771"],"related":[],"title":"Linux kernel: short USB transfer leaks stale heap bytes via sysfs","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: storage: sierra_ms: reject short SWoC info transfers\n\nsierra_get_swoc_info() requests sizeof(struct swoc_info) (60) bytes\nfrom the device via usb_control_msg(), but its callers only treat a\nnegative return value as failure. A device that answers the\nvendor-specific GetSwocInfo request with a short IN transfer is\ntherefore accepted, leaving the tail of the freshly allocated\n(kmalloc(), non-zeroing) swoc_info buffer uninitialized.\n\ntruinst_show() subsequently prints swocInfo->rev, swocInfo->LinuxSKU\nand swocInfo->LinuxVer from that buffer into the world-readable\n(0444) \"truinst\" sysfs attribute. An emulated/malicious USB device\n(VID 0x1199, PID 0x0fff) can exploit this to disclose up to 5 bytes\nof stale kernel heap memory (kmalloc-64) to unprivileged userspace,\nonce per sysfs read, indefinitely. On kernels built without\ninit_on_alloc this leaks recently freed heap contents.\n\nOnly accept the transfer when the full structure was received.\nsierra_ms_init() already retries failed queries, so well-behaved\ndevices are unaffected.","summary":"The Linux sierra_ms USB storage driver accepts a short device response and leaves part of a kernel heap buffer uninitialized. A malicious or emulated USB device can make that stale heap data readable by any local user through the world-readable truinst sysfs attribute.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","self-hosted","usb"],"not_affected_if":["no-sierra-ms-driver","no-untrusted-usb-devices"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit rejecting short SWoC info transfers in sierra_ms (version unknown from the sources).","status":"open","published_at":"2026-10-18T16:17:31+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:15:31+00:00","updated_at":"2026-10-25T05:15:31+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:15:31Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit rejecting short SWoC info transfers in sierra_ms (version unknown from the sources).","reach":"local","title":"Linux kernel: short USB transfer leaks stale heap bytes via sysfs","impact":"low","summary":"The Linux sierra_ms USB storage driver accepts a short device response and leaves part of a kernel heap buffer uninitialized. A malicious or emulated USB device can make that stale heap data readable by any local user through the world-readable truinst sysfs attribute.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","usb","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"unprivileged local users read up to 5 bytes of stale kernel heap","analyst_note":"Check the NVD entry and the upstream kernel commit for affected and fixed kernel version ranges and whether the driver is built by default.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-sierra-ms-driver","no-untrusted-usb-devices"],"who_is_affected":"Systems running a Linux kernel with the usb-storage sierra_ms driver built in or loaded, where a USB device with VID 0x1199 and PID 0x0fff can be attached. The sources do not say which kernel versions are affected, and they do not say whether a default configuration loads the driver. Systems that do not use this driver or cannot attach USB devices are unlikely to be exposed.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000647,"input_tokens":3658,"output_tokens":563,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-64':198C '-98771':14A,17A '0444':171C '0x0fff':182C '0x1199':180C '5':190C '60':99C 'accept':32B,136C,221C 'alloc':143C,213C 'alreadi':233C 'answer':122C 'attribut':70B,174C 'behav':240C 'buffer':44B,150C,165C 'built':209C 'byte':9A,100C,191C 'caller':110C 'content':219C 'control':106C 'cve':12A,15A 'data':57B 'devic':35B,51B,103C,120C,178C,241C 'disclos':187C 'driver':31B 'emul':49B 'emulated/malicious':176C 'exploit':184C 'fail':235C 'failur':118C 'follow':76C 'freed':217C 'fresh':142C 'full':226C 'get':91C 'getswocinfo':127C 'heap':8A,43B,56B,195C,218C 'host':23B 'indefinit':206C 'info':88C,93C,98C,149C 'infrastructur':18B 'init':211C,232C 'kernel':2A,19B,42B,74C,194C,208C 'kmalloc':144C,197C 'leak':6A,215C 'leav':38B,137C 'linux':1A,20B,26B,73C 'linuxsku':159C 'linuxv':162C 'local':61B 'make':53B 'malici':47B 'memori':196C 'ms':28B,84C,231C 'msg':107C 'negat':114C 'non':146C 'non-zero':145C 'part':39B 'per':203C 'pid':181C 'print':155C 'queri':236C 'read':205C 'readabl':58B,67B,170C 'receiv':229C 'recent':216C 'reject':85C 'request':94C,128C 'resolv':80C 'respons':36B 'retri':234C 'return':115C 'rev':157C 'self':22B 'self-host':21B 'short':3A,34B,86C,131C 'show':153C 'sierra':27B,83C,90C,230C 'sizeof':95C 'specif':126C 'stale':7A,55B,193C 'storag':30B,82C 'struct':96C 'structur':227C 'subsequ':154C 'swoc':87C,92C,97C,148C 'swocinfo':156C,158C,161C 'sysf':11A,69B,173C,204C 'tail':139C 'therefor':135C 'transfer':5A,89C,133C,223C 'treat':112C 'truinst':68B,152C,172C 'unaffect':243C 'uniniti':45B,151C 'unprivileg':200C 'usb':4A,24B,29B,50B,81C,105C,177C 'user':62B 'userspac':201C 'valu':116C 'vendor':125C 'vendor-specif':124C 'via':10A,104C 'vid':179C 'vulner':77C 'well':239C 'well-behav':238C 'without':210C 'world':66B,169C 'world-read':65B,168C 'zero':147C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the usb-storage sierra_ms driver built in or loaded, where a USB device with VID 0x1199 and PID 0x0fff can be attached. The sources do not say which kernel versions are affected, and they do not say whether a default configuration loads the driver. Systems that do not use this driver or cannot attach USB devices are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98771","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98771","severity":null,"published_at":"2026-10-18T16:17:31+00:00","modified_at":"2026-10-21T13:21:45+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}