SB20260912397 - Use of uninitialized resource in Linux kernel usb

Description

This security bulletin contains information about 1 vulnerability.

1) Use of uninitialized resource (CVE-ID: CVE-2026-80970)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in the ALSA FCP fcp_ioctl_init() response buffer when processing a short or zero-length step-0 USB control transfer. An attacker with physical access can cause a USB device to return a short or zero-length step-0 response to disclose sensitive information.

The disclosure is limited to the step-0 response region.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/29ab2df278ab4f1d238cd9c1c393ee00db175cba
• https://git.kernel.org/stable/c/4335e387786479889e6db691fe06d345e52ea536