The usblp USB printer driver contains a heap‑based information disclosure. When a device is first probed, its status buffer is allocated but never initialized. A malicious USB printer that sends an empty or too‑short response to the LPGETSTATUS ioctl causes the kernel to copy this uninitialized buffer to user space. The caller can therefore read arbitrary kernel‑heap contents, leaking sensitive data but not granting code execution or privilege escalation.

All Linux kernel installations that ship the usblp driver are susceptible. The flaw exists in every kernel version prior to the commit that zeros the status buffer at probe time. The issue spans major kernel series, including historic versions such as 2.6.12 and recent releases such as 7.1; any distribution compiling the standard kernel will be affected unless the usblp module is omitted.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% means exploitation is currently considered unlikely. An attacker would need to present a USB printer device that can issue the LPGETSTATUS ioctl; thus the attack requires either physical access or remote access to the USB bus. No evidence of code execution or privilege escalation exists, and the vulnerability is not listed in CISA’s KEV catalog.