The vulnerability resides in the Linux kernel USB printer driver (usblp). During a GET_DEVICE_ID control transfer, the driver trusts an advertised length supplied by the device, reading up to 1021 bytes from a 1024‑byte buffer that is not cleared before each request. When a device replies with a two‑byte length prefix that claims a lengthy ID but actually supplies only the prefix bytes, the remaining buffer remains populated with stale heap contents. This stale data can be accessed through the ieee1284_id sysfs attribute and the IOCNR_GET_DEVICE_ID ioctl, leading to the disclosure of uninitialized memory to the calling context. The weakness is classified as CWE‑824 and CWE‑401 (memory leak).

The affected product is the Linux kernel on all distributions that include the usblp driver, as indicated by the vendor products list Linux:Linux. No specific kernel version range is cited, so any kernel that contains the pre‑patch code is vulnerable.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% suggests a very low probability of exploitation. The vulnerability requires a malicious USB printer device to send a crafted short GET_DEVICE_ID response, so it is exploitable only on systems that have the usblp driver enabled and accept USB printer connections. Even in those environments, the exposed stale data could reveal application secrets or internal kernel structures to local users with access to the IOCNR_GET_DEVICE_ID ioctl or the ieee1284_id sysfs attribute. The issue is not listed in the CISA KEV catalog, and no product‑level warning is currently available, so immediate patching remains the most prudent course of action. The current CWE mapping lists only CWE‑824 and CWE‑401.