The Linux kernel ALSA FCP driver function fcp_ioctl_init() allocates a response buffer with kmalloc() but does not clear it before copying the entire buffer back to userspace. The step-0 USB control transfer, which writes part of this buffer, can complete with a short or zero-length data stage that is incorrectly treated as success. As a result, uninitialized kernel memory from the allocated buffer is copied to userspace, potentially disclosing kernel memory contents. The vulnerability was resolved by zeroing the buffer before use and requiring the step-0 transfer to deliver the full expected response size, treating short transfers as errors.

This vulnerability can lead to information disclosure by leaking uninitialized kernel memory to userspace. The leaked data may include sensitive kernel memory contents such as kernel text addresses, which could aid an attacker in further exploitation or bypassing security mechanisms. There is no indication of remote code execution or privilege escalation directly from this flaw.

A fix is available that zeroes the response buffer before copying it to userspace and enforces that the step-0 USB control transfer returns the full expected data length. Users should apply the official Linux kernel patches that address this issue. No additional mitigation is required if the system is updated.