CVE-2026-98771: Linux Kernel USB Storage Info Disclosure

CVE-2026-98771 Overview

CVE-2026-98771 is an uninitialized memory disclosure vulnerability in the Linux kernel usb-storage driver, specifically in the sierra_ms module. The sierra_get_swoc_info() function requests 60 bytes (sizeof(struct swoc_info)) from a USB device via usb_control_msg(), but callers only check for negative return values. A device that responds with a short IN transfer leaves the tail of a non-zeroed kmalloc() buffer uninitialized. That stale heap data is then exposed through the world-readable (0444) truinst sysfs attribute.

Critical Impact
A malicious or emulated USB device matching VID 0x1199 / PID 0x0fff can leak up to 5 bytes of kernel heap memory from the kmalloc-64 slab to unprivileged userspace on each sysfs read, repeatable indefinitely.

Affected Products

Linux kernel versions containing the drivers/usb/storage/sierra_ms.c driver
Kernels built without init_on_alloc enabled are most exposed to stale heap content
Systems that load usb-storage with Sierra Wireless SWoC device support

Discovery Timeline

2026-10-18 - CVE-2026-98771 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98771

Vulnerability Analysis

The flaw sits in the Sierra Wireless SWoC (Switch Wireless on Command) handling path in drivers/usb/storage/sierra_ms.c. The function sierra_get_swoc_info() issues a vendor-specific GetSwocInfo control transfer and expects a 60-byte struct swoc_info response. The buffer is allocated with kmalloc(), which does not zero memory. Callers treat only a negative return value as failure, so a short IN transfer is accepted as success.

After a short transfer, bytes beyond the device-supplied payload retain whatever content was previously in the kernel heap slab. The truinst_show() sysfs handler then formats swocInfo->rev, swocInfo->LinuxSKU, and swocInfo->LinuxVer into the truinst attribute. Because the attribute mode is 0444, any local user can read it. Each read triggers a new control transfer and a new leak opportunity.

Root Cause

The root cause is missing length validation on a USB control transfer return value, combined with use of non-zeroing allocation. This is an Uninitialized Memory Use condition that produces an Information Disclosure. The fix accepts the transfer only when the full sizeof(struct swoc_info) byte count is received. sierra_ms_init() already retries failed queries, so compliant devices are unaffected.

Attack Vector

Exploitation requires physical USB access or an emulated USB gadget (for example, a programmable device such as a Raspberry Pi Zero or Facedancer) that advertises VID 0x1199 and PID 0x0fff. The hostile device responds to the vendor-specific GetSwocInfo request with fewer than 60 bytes. Any unprivileged local user then reads /sys/.../truinst repeatedly to harvest residual heap contents from the kmalloc-64 slab. On kernels built without init_on_alloc, this leaks recently freed heap data that may include pointers or small secrets useful for defeating KASLR or chaining further attacks.

Detection Methods for CVE-2026-98771

Indicators of Compromise

Unexpected USB device enumeration events for VID 0x1199 / PID 0x0fff on systems that do not legitimately use Sierra Wireless modems
Repeated userspace reads of truinst sysfs attributes under /sys/bus/usb/ paths bound to the sierra_ms module
Kernel log entries from usb-storage indicating short control transfers from Sierra Wireless devices

Detection Strategies

Monitor udev and kernel ring buffer events for USB attachments matching the Sierra Wireless SWoC vendor/product identifiers on hosts without that hardware
Audit sysfs access patterns for repeated reads of truinst by non-root processes
Track loaded kernel modules and flag unexpected loading of usb_storage and sierra_ms on servers and workstations where USB mass storage is not needed

Monitoring Recommendations

Enable kernel auditing (auditd) rules on /sys/bus/usb/drivers/usb-storage/ reads to capture the identity of processes touching the attribute
Forward USB device connection telemetry to a centralized data lake for correlation across endpoints
Alert on new USB VID/PID pairs connecting to production hosts, especially those matching cellular modem identifiers

How to Mitigate CVE-2026-98771

Immediate Actions Required

Apply the upstream Linux kernel patch that enforces full-length validation of the SWoC control transfer response
Unload or blacklist the sierra_ms and usb_storage modules on hosts that do not require USB mass storage or Sierra Wireless modem support
Enforce USB device allowlisting through tools such as USBGuard to block unauthorized VID/PID pairs
Enable init_on_alloc=1 as a kernel boot parameter to zero newly allocated heap pages and reduce the value of any residual leak

Patch Information

The fix is distributed across multiple stable kernel branches. Relevant upstream commits:

The patch rejects the transfer unless the full struct swoc_info payload was received, preventing the uninitialized tail bytes from reaching sysfs.

Workarounds

Blacklist the vulnerable module by adding blacklist sierra_ms to /etc/modprobe.d/ and regenerating the initramfs
Restrict read access to the truinst sysfs attribute through filesystem ACLs or SELinux policy where unloading the module is not possible
Deploy USBGuard policies to block attachment of USB devices with VID 0x1199 / PID 0x0fff on hosts without legitimate Sierra Wireless hardware
Enable the init_on_alloc kernel feature to zero heap allocations and neutralize the information disclosure impact

bash

# Blacklist the vulnerable module and disable usb-storage where not needed
echo 'blacklist sierra_ms' | sudo tee /etc/modprobe.d/cve-2026-98771.conf
echo 'blacklist usb_storage' | sudo tee -a /etc/modprobe.d/cve-2026-98771.conf
sudo update-initramfs -u

# Enable init_on_alloc at boot (edit GRUB_CMDLINE_LINUX)
# GRUB_CMDLINE_LINUX="... init_on_alloc=1"
sudo update-grub