CVE-2026-46151 Overview
CVE-2026-46151 is a heap information disclosure vulnerability in the Linux kernel usblp driver. The flaw resides in how the driver handles short responses to the USB GET_DEVICE_ID control transfer used to retrieve IEEE 1284 printer device identifiers. A malicious or malfunctioning USB printer can trigger the driver to return up to 1021 bytes of uninitialized kernel heap memory to userspace through the ieee1284_id sysfs attribute and the IOCNR_GET_DEVICE_ID ioctl. The disclosed memory may contain sensitive kernel data adjacent to the 1024-byte kmalloc buffer allocated at probe time.
Critical Impact
An attacker-controlled USB device can leak kernel heap contents to userspace, exposing data that may aid in defeating Kernel Address Space Layout Randomization (KASLR) or recovering sensitive kernel state.
Affected Products
- Linux kernel usblp USB printer driver
- Distributions shipping affected stable kernel branches prior to the fix commits
- Systems where untrusted USB printer devices may be connected
Discovery Timeline
- 2026-05-28 - CVE-2026-46151 published to NVD
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-46151
Vulnerability Analysis
The usblp driver retrieves the IEEE 1284 device identifier string from USB printers using a GET_DEVICE_ID control transfer. The response begins with a 2-byte big-endian length prefix followed by the ASCII identifier. The driver allocates a 1024-byte buffer with kmalloc at probe time to hold this response.
The wrapper function usblp_ctrl_msg() collapses the return value of usb_control_msg() to either 0 or -errno, discarding the actual number of bytes transferred. When a printer completes the transfer with fewer bytes than requested, the driver cannot detect the short response.
The function usblp_cache_device_id_string() then reads the length prefix from the partially populated buffer and trusts it, clamping only to the buffer bounds. A device returning just two bytes such as 0x03 0xFF claims a 1023-byte identifier while leaving offsets 2 through 1022 holding uninitialized heap contents from the original kmalloc allocation.
Root Cause
The root cause is uninitialized memory use [CWE-908] combined with improper validation of a USB control transfer's actual transfer length. The driver trusts a device-supplied length field without verifying that the device actually wrote that many bytes into the buffer.
Attack Vector
An attacker requires the ability to attach a malicious USB device, or to emulate one through a compromised peripheral, to a target system. When the kernel probes the device as a printer, it issues the GET_DEVICE_ID request. The device responds with a minimal payload declaring a large length. The stale heap data is then exposed through two userspace interfaces: a sprintf("%s", buf+2) read of the ieee1284_id sysfs attribute, truncated at the first NUL byte in stale heap, and a copy_to_user() of the full claimed length via the IOCNR_GET_DEVICE_ID ioctl, leaking up to 1021 bytes of uninitialized heap regardless of NUL bytes.
The fix zeros the buffer with memset before each control transfer so any unwritten regions contain deterministic zeros rather than stale heap data. See the upstream patches at Kernel Git Commit 522d17e and Kernel Git Commit 7a400c6.
Detection Methods for CVE-2026-46151
Indicators of Compromise
- Unexpected USB printer device enumerations on servers, kiosks, or workstations that do not legitimately use printers.
- Userspace processes reading the /sys/class/usb/lp*/ieee1284_id attribute or invoking the IOCNR_GET_DEVICE_ID ioctl on /dev/usb/lp* outside of normal CUPS or print-spooler workflows.
- Kernel log entries from the usblp driver showing device IDs with unusual or non-printable content.
Detection Strategies
- Audit kernel versions across the fleet using uname -r and compare against patched stable releases identified in the upstream commits.
- Monitor USB device insertion events through udev, auditd USB rules, or the kernel audit subsystem to identify newly attached printer-class devices.
- Inspect process access patterns to /dev/usb/lp* and /sys/class/usb/lp* from unprivileged users or unexpected binaries.
Monitoring Recommendations
- Enable CONFIG_AUDIT and add watch rules for /dev/usb/lp* and /sys/class/usb/lp* to capture read operations.
- Forward dmesg and journald events related to usblp to a centralized logging system for correlation.
- Track USB device vendor and product identifiers against an allowlist of approved peripherals in managed environments.
How to Mitigate CVE-2026-46151
Immediate Actions Required
- Apply the upstream Linux kernel patches that zero the usblp device ID buffer before each control transfer.
- Update to the latest stable kernel release for your distribution that incorporates the fix.
- Restrict physical and logical access to USB ports on systems that do not require printer connectivity.
Patch Information
The vulnerability is resolved by upstream commits that initialize the usblp device ID buffer with zeros prior to issuing each GET_DEVICE_ID control transfer. The relevant stable tree commits are Kernel Git Commit 522d17e, Kernel Git Commit 6d81421, Kernel Git Commit 6e29c32, Kernel Git Commit 7a400c6, and Kernel Git Commit 8247f52. Consult your distribution's security advisory channels for backported builds.
Workarounds
- Blacklist the usblp kernel module on systems that do not require direct USB printer access by adding blacklist usblp to /etc/modprobe.d/.
- Use USB device authorization policies via /sys/bus/usb/devices/*/authorized or usbguard to deny unknown printer-class devices.
- Restrict permissions on /dev/usb/lp* and the ieee1284_id sysfs attribute so only trusted print services can read them.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
