Executive brief
The Linux kernel's USB mdc800 image scanner driver allocates memory buffers using kmalloc() without zeroing their contents. If incoming USB messages are shorter than the allocated buffer size, uninitialized kernel memory can leak to user space. This could expose sensitive kernel data or aid in defeating security mitigations.
Technical details
A memory initialization vulnerability in the USB mdc800 driver (drivers/usb/image/mdc800.c) stems from using kmalloc() instead of kzalloc() to allocate irq_urb_buffer and download_urb_buffer in usb_mdc800_init(). If a shorter USB message is received in mdc800_usb_irq() or mdc800_usb_download_notify(), the uninitialized remainder of the buffer is exposed to user space, leaking kernel memory. This is a local/adjacent-network vulnerability requiring device access. The fix is straightforward: replace kmalloc() with kzalloc() to zero-initialize allocations, preventing information disclosure.
Affected products
- Linux Linux kernel Upstream and stable kernels affected (patch applied to stable trees 2.6.11.y through 6.9.y and later)
Timeline
- 2026-09-16: disclosed: CVE-2026-90034 published