---
id: "CVE-2026-98771"
kind: "vulnerability"
aliases: ["CVE-2026-98771"]
title: "Linux kernel: short USB transfer leaks stale heap bytes via sysfs"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "kernel", "linux", "self-hosted", "usb"]
not_affected_if: ["no-sierra-ms-driver", "no-untrusted-usb-devices"]
published_at: "2026-10-18T16:17:31+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:15:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98771", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: short USB transfer leaks stale heap bytes via sysfs

The Linux sierra_ms USB storage driver accepts a short device response and leaves part of a kernel heap buffer uninitialized. A malicious or emulated USB device can make that stale heap data readable by any local user through the world-readable truinst sysfs attribute.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Update to a Linux kernel release that includes the upstream commit rejecting short SWoC info transfers in sierra_ms (version unknown from the sources).

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98771

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

usb: storage: sierra_ms: reject short SWoC info transfers

sierra_get_swoc_info() requests sizeof(struct swoc_info) (60) bytes
from the device via usb_control_msg(), but its callers only treat a
negative return value as failure. A device that answers the
vendor-specific GetSwocInfo request with a short IN transfer is
therefore accepted, leaving the tail of the freshly allocated
(kmalloc(), non-zeroing) swoc_info buffer uninitialized.

truinst_show() subsequently prints swocInfo->rev, swocInfo->LinuxSKU
and swocInfo->LinuxVer from that buffer into the world-readable
(0444) "truinst" sysfs attribute. An emulated/malicious USB device
(VID 0x1199, PID 0x0fff) can exploit this to disclose up to 5 bytes
of stale kernel heap memory (kmalloc-64) to unprivileged userspace,
once per sysfs read, indefinitely. On kernels built without
init_on_alloc this leaks recently freed heap contents.

Only accept the transfer when the full structure was received.
sierra_ms_init() already retries failed queries, so well-behaved
devices are unaffected.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_