CVE-2026-90034 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: image: mdc800: change kmalloc() to kzalloc()
Change the kmalloc() calls in usb_mdc800_init() for irq_urb_buffer and download_urb_buffer to kzalloc(), avoiding potential stack leaks if a shorter message is received in mdc800_usb_irq() and mdc800_usb_download_notify()
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel vulnerability identified within the usb_mdc800 driver involves an improper initialization of memory buffers, specifically classified under CWE-200 as an Information Exposure through Leaked Memory. The core technical flaw resides in the use of kmalloc for allocating irq_urb_buffer and download_urb_buffer during the device initialization phase via the usb_mdc800_init function. Unlike kzalloc, which zero-fills the allocated memory upon allocation, kmalloc does not guarantee that the returned memory is cleared of previous contents. This distinction becomes critical when the driver handles variable-length data transfers from USB devices.
The operational impact manifests during interrupt and download notification handlers, specifically mdc_mdc800_usb_irq and mdc800_usb_download_notify. In these routines, if a shorter message than expected is received or processed, the code may read beyond the valid length of the incoming data while still accessing the full size of the allocated buffer. Because kmalloc does not zero out the memory, any residual data from previous allocations in that kernel slab cache remains present in the unused portion of the buffer. When this uninitialized or stale memory is subsequently accessed due to logic errors regarding message boundaries, sensitive information previously stored in those memory locations can be inadvertently exposed. This scenario aligns with ATT&CK technique T1074, Data Staged, where attackers might leverage such leaks to gather intelligence about system state or other processes sharing the same kernel slab allocator.
This type of vulnerability is particularly dangerous because it does not typically result in immediate denial of service but rather provides a subtle channel for information leakage that can be exploited over time. The lack of memory initialization means that any cryptographic keys, authentication tokens, or private data previously allocated and freed in the same memory region could potentially be read by an attacker who controls the USB device interaction patterns. By switching to kzalloc, the kernel ensures that all bytes in the buffer are initialized to zero before use. This prevents the reading of stale data because even if the code accesses beyond the actual message length due to a logic error or malformed input, it will encounter null bytes rather than potentially sensitive information from prior allocations.
Mitigation for this issue requires updating the usb_mdc800 driver source code to replace all instances of kmalloc with kzalloc for buffers that are subject to variable-length reads without strict bounds checking against the actual data length versus buffer size. This change ensures memory safety and eliminates the risk of information exposure through uninitialized memory regions. For system administrators, applying kernel updates or patches that include this fix is essential to maintain security posture. Developers should also consider implementing stricter validation checks for message lengths before processing USB data to further reduce reliance on zero-filled buffers as a sole defense mechanism against out-of-bounds reads.