In the Linux kernel, the following vulnerability has been resolved: usb: storage: sierra_ms: reject short SWoC info transfers sierra_get_swoc_info()… (CVE-2026-98771)

The Linux kernel's usb storage driver for Sierra Wireless devices (sierra_ms) had a vulnerability where the sierra_get_swoc_info() function requested 60 bytes from the device but only treated negative return values as failures. If a malicious device responded with a short IN transfer, the driver accepted it, leaving the tail of the allocated swoc_info buffer uninitialized. The truinst_show() function then exposed parts of this uninitialized buffer (including rev, LinuxSKU, LinuxVer fields) via a world-readable sysfs attribute, leaking up to 5 bytes of stale kernel heap memory to unprivileged userspace. The fix ensures that only full-size transfers are accepted, preventing this information leak.

An attacker controlling a malicious USB device can exploit this vulnerability to leak small amounts of kernel heap memory to unprivileged userspace repeatedly. This information leak could potentially aid further attacks by revealing kernel memory contents. The leak is limited to up to 5 bytes per sysfs read and only occurs if the kernel is built without init_on_alloc, which zeroes memory on allocation.

A fix is available that rejects short SWoC info transfers and only accepts the full expected data size. The sierra_ms_init() function already retries failed queries, so well-behaved devices are unaffected. Users should update their Linux kernel to a version that includes this fix. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the official patch and remediation guidance.