CVE-2026-46151

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: usblp: fix heap leak in IEEE 1284 device ID via short response<br /> <br /> usblp_ctrl_msg() collapses the usb_control_msg() return value to<br /> 0/-errno, discarding the actual number of bytes transferred. A broken<br /> printer can complete the GET_DEVICE_ID control transfer short and the<br /> driver has no way to know.<br /> <br /> usblp_cache_device_id_string() reads the 2-byte big-endian length prefix<br /> from the response and trusts it (clamped only to the buffer bounds).<br /> The buffer is kmalloc(1024) at probe time. A device that sends exactly<br /> two bytes (e.g. 0x03 0xFF, claiming a 1023-byte ID) leaves<br /> device_id_string[2..1022] holding stale kmalloc heap.<br /> <br /> That stale data is then exposed:<br /> - via the ieee1284_id sysfs attribute (sprintf("%s", buf+2), truncated<br /> at the first NUL in the stale heap), and<br /> - via the IOCNR_GET_DEVICE_ID ioctl, which copy_to_user()s the full<br /> claimed length regardless of NULs, up to 1021 bytes of uninitialized<br /> heap, with the leak size chosen by the device.<br /> <br /> Fix this up by just zapping the buffer with zeros before each request<br /> sent to the device.