{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98771", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.369Z", "datePublished": "2026-10-18T15:48:07.367Z", "dateUpdated": "2026-10-30T12:39:39.761Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:39:39.761Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: storage: sierra_ms: reject short SWoC info transfers\n\nsierra_get_swoc_info() requests sizeof(struct swoc_info) (60) bytes\nfrom the device via usb_control_msg(), but its callers only treat a\nnegative return value as failure. A device that answers the\nvendor-specific GetSwocInfo request with a short IN transfer is\ntherefore accepted, leaving the tail of the freshly allocated\n(kmalloc(), non-zeroing) swoc_info buffer uninitialized.\n\ntruinst_show() subsequently prints swocInfo->rev, swocInfo->LinuxSKU\nand swocInfo->LinuxVer from that buffer into the world-readable\n(0444) \"truinst\" sysfs attribute. An emulated/malicious USB device\n(VID 0x1199, PID 0x0fff) can exploit this to disclose up to 5 bytes\nof stale kernel heap memory (kmalloc-64) to unprivileged userspace,\nonce per sysfs read, indefinitely. On kernels built without\ninit_on_alloc this leaks recently freed heap contents.\n\nOnly accept the transfer when the full structure was received.\nsierra_ms_init() already retries failed queries, so well-behaved\ndevices are unaffected."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/storage/sierra_ms.c"], "versions": [{"version": "32fe5e393455d87db4988af03915634304870fb4", "lessThan": "353ca2623104a3baf5642c3ea31569df04ce4aaf", "status": "affected", "versionType": "git"}, {"version": "32fe5e393455d87db4988af03915634304870fb4", "lessThan": "799810166646bcf9dc5a4e77bc4b0bdf6bc443f2", "status": "affected", "versionType": "git"}, {"version": "32fe5e393455d87db4988af03915634304870fb4", "lessThan": "411da2ec8c62bfa39407e5a20d659b973b3cf311", "status": "affected", "versionType": "git"}, {"version": "32fe5e393455d87db4988af03915634304870fb4", "lessThan": "4faaad69f18332246bbd4ca41718beb2a305bb72", "status": "affected", "versionType": "git"}, {"version": "32fe5e393455d87db4988af03915634304870fb4", "lessThan": "c85e8331d298b8f1dee8fe63718e76435cec7133", "status": "affected", "versionType": "git"}, {"version": "32fe5e393455d87db4988af03915634304870fb4", "lessThan": "e2d62928f2666a2964a23b1d39e6e762f0628d7b", "status": "affected", "versionType": "git"}, {"version": "32fe5e393455d87db4988af03915634304870fb4", "lessThan": "db9d3be156baca6ef80ae5d93acfeb85c61a74dd", "status": "affected", "versionType": "git"}, {"version": "32fe5e393455d87db4988af03915634304870fb4", "lessThan": "8a0200d14acd9db388b85cd016e68a4e60d900ec", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/storage/sierra_ms.c"], "versions": [{"version": "2.6.27", "status": "affected"}, {"version": "0", "lessThan": "2.6.27", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/353ca2623104a3baf5642c3ea31569df04ce4aaf"}, {"url": "https://git.kernel.org/stable/c/799810166646bcf9dc5a4e77bc4b0bdf6bc443f2"}, {"url": "https://git.kernel.org/stable/c/411da2ec8c62bfa39407e5a20d659b973b3cf311"}, {"url": "https://git.kernel.org/stable/c/4faaad69f18332246bbd4ca41718beb2a305bb72"}, {"url": "https://git.kernel.org/stable/c/c85e8331d298b8f1dee8fe63718e76435cec7133"}, {"url": "https://git.kernel.org/stable/c/e2d62928f2666a2964a23b1d39e6e762f0628d7b"}, {"url": "https://git.kernel.org/stable/c/db9d3be156baca6ef80ae5d93acfeb85c61a74dd"}, {"url": "https://git.kernel.org/stable/c/8a0200d14acd9db388b85cd016e68a4e60d900ec"}], "title": "usb: storage: sierra_ms: reject short SWoC info transfers", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/storage/sierra_ms.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "353ca2623104a3baf5642c3ea31569df04ce4aaf", "status": "affected", "version": "32fe5e393455d87db4988af03915634304870fb4", "versionType": "git"}, {"lessThan": "799810166646bcf9dc5a4e77bc4b0bdf6bc443f2", "status": "affected", "version": "32fe5e393455d87db4988af03915634304870fb4", "versionType": "git"}, {"lessThan": "411da2ec8c62bfa39407e5a20d659b973b3cf311", "status": "affected", "version": "32fe5e393455d87db4988af03915634304870fb4", "versionType": "git"}, {"lessThan": "4faaad69f18332246bbd4ca41718beb2a305bb72", "status": "affected", "version": "32fe5e393455d87db4988af03915634304870fb4", "versionType": "git"}, {"lessThan": "c85e8331d298b8f1dee8fe63718e76435cec7133", "status": "affected", "version": "32fe5e393455d87db4988af03915634304870fb4", "versionType": "git"}, {"lessThan": "e2d62928f2666a2964a23b1d39e6e762f0628d7b", "status": "affected", "version": "32fe5e393455d87db4988af03915634304870fb4", "versionType": "git"}, {"lessThan": "db9d3be156baca6ef80ae5d93acfeb85c61a74dd", "status": "affected", "version": "32fe5e393455d87db4988af03915634304870fb4", "versionType": "git"}, {"lessThan": "8a0200d14acd9db388b85cd016e68a4e60d900ec", "status": "affected", "version": "32fe5e393455d87db4988af03915634304870fb4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/storage/sierra_ms.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.27"}, {"lessThan": "2.6.27", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: storage: sierra_ms: reject short SWoC info transfers\n\nsierra_get_swoc_info() requests sizeof(struct swoc_info) (60) bytes\nfrom the device via usb_control_msg(), but its callers only treat a\nnegative return value as failure. A device that answers the\nvendor-specific GetSwocInfo request with a short IN transfer is\ntherefore accepted, leaving the tail of the freshly allocated\n(kmalloc(), non-zeroing) swoc_info buffer uninitialized.\n\ntruinst_show() subsequently prints swocInfo->rev, swocInfo->LinuxSKU\nand swocInfo->LinuxVer from that buffer into the world-readable\n(0444) \"truinst\" sysfs attribute. An emulated/malicious USB device\n(VID 0x1199, PID 0x0fff) can exploit this to disclose up to 5 bytes\nof stale kernel heap memory (kmalloc-64) to unprivileged userspace,\nonce per sysfs read, indefinitely. On kernels built without\ninit_on_alloc this leaks recently freed heap contents.\n\nOnly accept the transfer when the full structure was received.\nsierra_ms_init() already retries failed queries, so well-behaved\ndevices are unaffected."}], "id": "CVE-2026-98771", "lastModified": "2026-10-30T13:21:26.747", "metrics": {}, "published": "2026-10-18T16:17:31.020", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/353ca2623104a3baf5642c3ea31569df04ce4aaf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/411da2ec8c62bfa39407e5a20d659b973b3cf311"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4faaad69f18332246bbd4ca41718beb2a305bb72"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/799810166646bcf9dc5a4e77bc4b0bdf6bc443f2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8a0200d14acd9db388b85cd016e68a4e60d900ec"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c85e8331d298b8f1dee8fe63718e76435cec7133"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/db9d3be156baca6ef80ae5d93acfeb85c61a74dd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e2d62928f2666a2964a23b1d39e6e762f0628d7b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: usb: storage: sierra_ms: reject short SWoC info transfers", "id": "2555130", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555130"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-908", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nusb: storage: sierra_ms: reject short SWoC info transfers\nsierra_get_swoc_info() requests sizeof(struct swoc_info) (60) bytes\nfrom the device via usb_control_msg(), but its callers only treat a\nnegative return value as failure. A device that answers the\nvendor-specific GetSwocInfo request with a short IN transfer is\ntherefore accepted, leaving the tail of the freshly allocated\n(kmalloc(), non-zeroing) swoc_info buffer uninitialized.\ntruinst_show() subsequently prints swocInfo->rev, swocInfo->LinuxSKU\nand swocInfo->LinuxVer from that buffer into the world-readable\n(0444) \"truinst\" sysfs attribute. An emulated/malicious USB device\n(VID 0x1199, PID 0x0fff) can exploit this to disclose up to 5 bytes\nof stale kernel heap memory (kmalloc-64) to unprivileged userspace,\nonce per sysfs read, indefinitely. On kernels built without\ninit_on_alloc this leaks recently freed heap contents.\nOnly accept the transfer when the full structure was received.\nsierra_ms_init() already retries failed queries, so well-behaved\ndevices are unaffected.", "A flaw was found in the Linux kernel's Sierra Wireless USB storage driver. This vulnerability can lead to an information disclosure because the driver does not verify whether a complete data response is received from an attached device, leaving kernel memory uninitialized. A malicious or emulated USB (Universal Serial Bus) device can provide a truncated response, allowing an unprivileged local user to read stale kernel heap memory through exposed system status files."], "name": "CVE-2026-98771", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98771\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98771\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98771.mbox"], "threat_severity": "Low"}