PT-2026-44274 · Linux · Linux Kernel

Published 2026-05-28 · Updated 2026-06-09 · CVE-2026-46151

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.11-1.1

Description A heap leak exists in the usblp driver when handling IEEE 1284 device IDs. The usblp ctrl msg() function discards the actual number of bytes transferred during a usb control msg() call. If a device provides a short response to a GET DEVICE ID control transfer, the usblp cache device id string() function may trust a length prefix that exceeds the actual data received. This allows a device to expose uninitialized heap data through the ieee1284 id sysfs attribute and the IOCNR GET DEVICE ID ioctl, which uses copy to user() to send the claimed length of data to the user.

Recommendations Update to version 7.0.11-1.1 or newer.

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2026-46151

ECHO-67EB-894F-DE4C

OESA-2026-2580

OPENSUSE-SU-2026:10954-1

Affected Products

Linux Kernel

References · 353

• https://nvd.nist.gov/vuln/detail/CVE-2026-31466 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-54285 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43281 · Security Note
• https://git.kernel.org/stable/c/612640abbd9e0947fe8f37aaf0cf324265d7caa4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-46151 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2580 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23272 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31588 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-46151 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46167 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-39864 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-46181 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-46187 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-71067 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-68223 · Security Note