The vulnerability resides in the Linux kernel USB printer driver (usblp). During a GET_DEVICE_ID control transfer, the driver trusts an advertised length supplied by the device, reading up to 1021 bytes from a 1024‑byte buffer that is not cleared before each request. When a device replies with a two‑byte length prefix that claims a lengthy ID but actually supplies only the prefix bytes, the remaining buffer remains populated with stale heap contents. This stale data can be accessed through the ieee1284_id sysfs attribute and the IOCNR_GET_DEVICE_ID ioctl, leading to the disclosure of uninitialized memory to the calling context.

The affected product is the Linux kernel on all distributions that include the usblp driver, as indicated by the vendor products list Linux:Linux and the CPE string cpe:2.3:o:linuxlinux_kernel:*:*:*:*:*:*:*.*. No specific kernel version range is cited, so any kernel that contains the pre‑patch code is vulnerable.

The CVSS score is not disclosed, and the EPSS score is unavailable, indicating no publicly known exploitation probability. The vulnerability requires active need for a malicious USB printer device to supply a crafted short response, so it is exploitable only on systems that accept USB printer connections or have the usblp driver enabled. Although the risk is limited to those environments, the exposed stale data could expose application secrets or internal kernel structures to local users with access to the ioctl or sysfs interface. The vulnerability is not listed in CISA KEV and no product‐level warning is currently available, making immediate patching the most prudent approach.