CVE-2026-98771

In the Linux kernel, the following vulnerability has been resolved:

usb: storage: sierra ms: reject short SWoC info transfers

sierra get swoc info() requests sizeof(struct swoc info) (60) bytes from the device via usb control msg(), but its callers only treat a negative return value as failure. A device that answers the vendor-specific GetSwocInfo request with a short IN transfer is therefore accepted, leaving the tail of the freshly allocated (kmalloc(), non-zeroing) swoc info buffer uninitialized.

truinst show() subsequently prints swocInfo->rev, swocInfo->LinuxSKU and swocInfo->LinuxVer from that buffer into the world-readable (0444) "truinst" sysfs attribute. An emulated/malicious USB device (VID 0x1199, PID 0x0fff) can exploit this to disclose up to 5 bytes of stale kernel heap memory (kmalloc-64) to unprivileged userspace, once per sysfs read, indefinitely. On kernels built without init on alloc this leaks recently freed heap contents.

Only accept the transfer when the full structure was received. sierra ms init() already retries failed queries, so well-behaved devices are unaffected.