CVE-2026-90034: Linux Kernel USB MDC800 Memory Leak Vulnerability

CVE-2026-90034 Overview

CVE-2026-90034 is a Linux kernel vulnerability in the mdc800 USB image driver. The flaw involves uninitialized memory use in URB buffers allocated by usb_mdc800_init(). Two buffers, irq_urb_buffer and download_urb_buffer, were allocated with kmalloc(), which does not zero the returned memory. When mdc800_usb_irq() or mdc800_usb_download_notify() processes a shorter-than-expected message, residual kernel data can remain in the buffer and be exposed to callers. The upstream fix replaces kmalloc() with kzalloc() to guarantee zero-initialized allocations.

Critical Impact
Potential disclosure of uninitialized kernel memory contents through the mdc800 USB image driver when short USB messages are received.

Affected Products

Linux kernel (upstream) — drivers/usb/image/mdc800.c
Stable branches referenced by the fix commits listed in the kernel.org stable tree
Systems using the Mustek MDC-800 USB digital camera driver (mdc800)

Discovery Timeline

2026-09-16 - CVE-2026-90034 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-90034

Vulnerability Analysis

The mdc800 driver supports the Mustek MDC-800 USB digital camera. During initialization, usb_mdc800_init() allocates two DMA-capable URB (USB Request Block) buffers used to receive interrupt and download messages from the device. The original code used kmalloc(), which allocates memory without clearing prior contents. That memory may contain residual data from previous kernel allocations, including sensitive kernel state.

When the device or a malicious USB peripheral responds with a message shorter than the buffer size, only the transmitted bytes are overwritten. The unwritten tail of the buffer retains uninitialized kernel memory. Downstream code paths in mdc800_usb_irq() and mdc800_usb_download_notify() may then propagate this residual data to userspace or into other kernel structures.

Root Cause

The root cause is Uninitialized Memory Use ([CWE-908]) in kernel buffer allocation. kmalloc() returns memory in an indeterminate state. Any code path that assumes buffers are pre-zeroed, or that trusts the received length to fully populate the buffer, can leak kernel information. The patch changes the two allocations to kzalloc(), which returns zeroed memory and eliminates the residual-data condition.

Attack Vector

Exploitation requires a USB device that presents as an mdc800-compatible camera and returns short interrupt or download messages. Local attackers with physical access, or with the ability to attach a USB device (including through a virtualized USB pass-through), can trigger the shortened response path. The resulting information disclosure exposes uninitialized kernel bytes to processes that read from the driver, aiding kernel address leaks or bypassing KASLR-style mitigations.

No public exploit is available for CVE-2026-90034. See the upstream commits listed under references for the exact code change: Linux Kernel Commit 2430eb8 and Linux Kernel Commit 553c375.

Detection Methods for CVE-2026-90034

Indicators of Compromise

Unexpected attachment of USB devices identifying as Mustek MDC-800 cameras on servers or workstations without a legitimate need for that hardware class.
Kernel log entries from the mdc800 driver on hosts where the module is not expected to load.
Anomalous short USB interrupt transfers targeting the mdc800 endpoints.

Detection Strategies

Inventory hosts running kernel versions predating the fix commits referenced in the kernel.org stable tree.
Query endpoint telemetry for the presence of the mdc800 kernel module (lsmod | grep mdc800) and flag unexpected loads.
Correlate USB device attachment events with process activity to detect drivers loading in response to untrusted peripherals.

Monitoring Recommendations

Monitor udev and kernel ring buffer events for mdc800 driver binding on production systems.
Alert when previously unseen USB vendor and product IDs bind to legacy image-class drivers.
Track kernel package inventory across the fleet to identify unpatched hosts.

How to Mitigate CVE-2026-90034

Immediate Actions Required

Update Linux kernels to a version that includes the kmalloc() to kzalloc() change in drivers/usb/image/mdc800.c.
On systems that do not require support for the Mustek MDC-800 camera, blacklist the mdc800 module to prevent it from loading.
Restrict physical USB access on sensitive systems and enforce USB device allow-lists where feasible.

Patch Information

The fix is distributed across multiple stable branches. Reference commits include Linux Kernel Commit 2df8f77, Linux Kernel Commit 67c6726, Linux Kernel Commit 6c60141, Linux Kernel Commit 838455c, Linux Kernel Commit 8c38049, and Linux Kernel Commit e22428f. Apply your distribution's kernel update once it incorporates the change.

Workarounds

Blacklist the mdc800 module via /etc/modprobe.d/blacklist-mdc800.conf on hosts that never use this camera driver.
Disable automatic module loading for USB image-class devices where operational requirements permit.
Enforce USB port control through hardware policy or endpoint controls on systems handling sensitive kernel data.

bash

# Configuration example: prevent the mdc800 driver from auto-loading
echo "blacklist mdc800" | sudo tee /etc/modprobe.d/blacklist-mdc800.conf
sudo modprobe -r mdc800 2>/dev/null || true
sudo update-initramfs -u