Executive brief
A vulnerability in the Linux USB printer driver could allow a malicious USB device to leak small amounts of sensitive kernel memory. By mimicking a printer and sending incomplete status responses, the device can trick the computer into revealing data previously stored in its memory. This could potentially expose technical details about the system's internal operations to an attacker with physical access.
Technical details
An information leak exists in the Linux kernel's usblp driver due to the use of uninitialized heap memory. The 'statusbuf' buffer is allocated using kmalloc() during device probing but is not zeroed. When a user triggers the LPGETSTATUS ioctl, the driver requests status data from the USB device. If a malicious or faulty USB device responds with zero bytes, the driver fails to detect the short read because usblp_ctrl_msg() collapses the return value to 0. Consequently, the stale data in the uninitialized heap buffer is copied back to the user via copy_to_user(). The fix involves replacing kmalloc() with kzalloc() to ensure the buffer is zero-initialized.
Affected products
- Linux Linux Kernel All versions prior to the May 2026 patches
Timeline
- 2026-04-20: patched: Initial patch authored by Greg Kroah-Hartman
- 2026-05-28: advisory: CVE-2026-46167 published
References
- https://git.kernel.org/stable/c/6b0e7438e31c74b01514d31ff35c1e688c4baaba
- https://git.kernel.org/stable/c/762a6ccf391db0d629e590a803a3a2231e17dd3f
- https://git.kernel.org/stable/c/a502b997668401a6821501fc98b7f9220f9b6ff2
- https://git.kernel.org/stable/c/b38e53cbfb9d84732e5984fbd73e128d592415c5
- https://git.kernel.org/stable/c/d06d937b0a4cdb8867f04275c8100a8b943da31a