Use of uninitialized resource in Linux kernel - CVE-2026-98771

Vulnerability identifier: #VU157135

CSH Severity: Low

CVSS v4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98771

CWE-ID: CWE-908

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows an attacker with physical access to system to disclose stale kernel heap memory to unprivileged userspace.

The vulnerability exists due to use of uninitialized memory in the Linux kernel sierra_ms USB storage driver when accepting short responses to GetSwocInfo requests. An attacker with physical access to system can connect a malicious USB device with vendor ID 0x1199 and product ID 0x0fff that returns a short response to expose up to 5 bytes of stale kernel heap memory per read of the world-readable truinst sysfs attribute on kernels built without init_on_alloc.

Linux kernel
SUSE Linux Micro
SUSE Linux Micro Extras
kernel-default
kernel-64kb
kernel-64kb-debugsource
kernel-64kb-devel
kernel-default-devel
kernel-syms
kernel-obs-build
kernel-obs-build-debugsource
kernel-default-debugsource
kernel-default-devel-debuginfo

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel-default - update to 6.4.0-159998.55.1
kernel-64kb - update to 6.4.0-159998.55.1
kernel-64kb-debugsource - update to 6.4.0-159998.55.1
kernel-64kb-devel - update to 6.4.0-159998.55.1
kernel-default-devel - update to 6.4.0-159998.55.1
kernel-syms - update to 6.4.0-159998.55.1
kernel-obs-build - update to 6.4.0-159998.55.1
kernel-obs-build-debugsource - update to 6.4.0-159998.55.1
kernel-default-debugsource - update to 6.4.0-159998.55.1
kernel-default-devel-debuginfo - update to 6.4.0-159998.55.1

• https://git.kernel.org/stable/c/4faaad69f18332246bbd4ca41718beb2a305bb72
• https://git.kernel.org/stable/c/8a0200d14acd9db388b85cd016e68a4e60d900ec
• https://git.kernel.org/stable/c/c85e8331d298b8f1dee8fe63718e76435cec7133
• https://git.kernel.org/stable/c/db9d3be156baca6ef80ae5d93acfeb85c61a74dd
• https://git.kernel.org/stable/c/e2d62928f2666a2964a23b1d39e6e762f0628d7b

• Use of uninitialized resource in Linux kernel usb storage driver
• SUSE update for the Linux Kernel