Cloudanix VulnDB

CVE-2026-98771

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem handling certain USB devices could let someone with physical access read tiny pieces of the computer's internal memory that should have stayed private.

Exploitation
Physical Access
Attacker needs
Physical Access
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The driver accepts short USB control transfers for SWoC info, leaving the tail of a kmalloc-64 buffer uninitialized; subsequent reads of the world-readable truinst sysfs attribute expose up to 5 bytes of stale kernel heap contents to unprivileged userspace.

Why it matters to the business

Attackers with physical or emulated USB access can repeatedly obtain small fragments of recent kernel memory, raising the risk of credential or pointer leaks on systems that have not applied the fix; the issue affects any Linux distribution shipping the vulnerable sierra_ms code.

How an attack unfolds

An attacker presents a malicious USB device (VID 0x1199, PID 0x0fff) that responds to the GetSwocInfo request with fewer than 60 bytes; the kernel stores the partial reply without clearing the remainder of the buffer, after which any local user can read the leaked bytes by opening the truinst sysfs file.

How to fix it

Apply the upstream kernel commit that enforces a full 60-byte transfer in sierra_get_swoc_info(); rebuild and reboot onto a kernel containing the fix; where immediate patching is impossible, restrict unprivileged access to the sierra_ms sysfs attributes via mount options or LSM policy.

How to confirm the fix worked

Confirm the patched driver rejects transfers shorter than sizeof(struct swoc_info) by inspecting the return value check in sierra_get_swoc_info(); test with a device that supplies a short reply and verify that truinst no longer contains uninitialized bytes.

Typical attack path

  1. Attacker connects malicious USB device emulating VID 0x1199 PID 0x0fff
  2. Kernel driver issues usb_control_msg for struct swoc_info
  3. Device returns short transfer; driver stores result without zeroing tail
  4. Unprivileged process opens the truinst sysfs attribute
  5. Leaked kernel-heap bytes are returned to userspace

How to detect it

Look in kernel logs for usb_control_msg short-transfer warnings involving the Sierra vendor-specific request; monitor sysfs reads of the truinst attribute by unprivileged processes; correlate with insertion of VID 0x1199 PID 0x0fff devices.

  • VID:0x1199 PID:0x0fff
  • truinst
  • sierra_get_swoc_info
  • usb_control_msg.*short

What your security team should do

  • Prioritize kernel updates on any system exposing Sierra USB modems to untrusted users
  • Monitor EPSS and exploit maturity; raise priority if in-the-wild exploitation is observed
  • Temporarily disable the sierra_ms driver or the truinst attribute on high-risk endpoints until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: usb: storage: sierra_ms: reject short SWoC info transfers sierra_get_swoc_info() requests sizeof(struct swoc_info) (60) bytes from the device via usb_control_msg(), but its callers only treat a negative return value as failure. A device that answers the vendor-specific GetSwocInfo request with a short IN transfer is therefore accepted, leaving the tail of the freshly allocated (kmalloc(), non-zeroing) swoc_info buffer uninitialized. truinst_show() subsequently prints swocInfo->rev, swocInfo->LinuxSKU and swocInfo->LinuxVer from that buffer into the world-readable (0444) "truinst" sysfs attribute. An emulated/malicious USB device (VID 0x1199, PID 0x0fff) can exploit this to disclose up to 5 bytes of stale kernel heap memory (kmalloc-64) to unprivileged userspace, once per sysfs read, indefinitely. On kernels built without init_on_alloc this leaks recently freed heap contents. Only accept the transfer when the full structure was received. sierra_ms_init() already retries failed queries, so well-behaved devices are unaffected.

Affected packages

Ecosystem Package Introduced Fixed