CVE-2026-90034 - Vulnerability Details

- usb: image: mdc800: change kmalloc() to kzalloc()

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: image: mdc800: change kmalloc() to kzalloc()

Change the kmalloc() calls in usb_mdc800_init() for irq_urb_buffer and
download_urb_buffer to kzalloc(), avoiding potential stack leaks if a
shorter message is received in mdc800_usb_irq() and
mdc800_usb_download_notify()

Published: 2026-09-16

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability was a kernel bug in the USB image driver for the MDC800 device. The driver allocated buffers with kmalloc() that were not zero‑initialized. When a shorter USB message arrived, leftover bytes from the previous allocation could remain in the buffer, leaking kernel stack contents. This could provide an attacker with sensitive internal data, leading to information disclosure.

Affected Systems

Any Linux system using the default kernel with the usb_mdc800 driver before the patch is affected. All distributions that ship the kernel version containing the bug – according to the CPE, linux_kernel.* – are potentially impacted until they apply the fix.

Risk and Exploitability

The EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating a low but not negligible chance of exploitation. The attack requires local or physical access to the USB MDC800 device and the ability to inject crafted messages; it does not provide remote code execution or privilege escalation. The patch that changes kmalloc() to kzalloc() eliminates the leak entirely.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 6c601410d1a9ae645f604fe2f61b9f4942c77dfb
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 2df8f7720ed91f1aad4f128553b6e90c7c5fac1e
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 67c6726dd6048a2781aa43a2bf9fcf1e16ee3a7d
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 553c375e86a49882e95840565512e17bff31cc3a
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 8c38049879f2108f57c98f03cc7f3db51a12bdab
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 838455cc8bfe1278150d1d776529edea6cd4c1dd
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< e22428f0c038c23109c0383a235aa607b0cd4c95
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 2430eb81e44111b30eeb5273bbcf8b24ca517ef9

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.5`	unaffected	≤ 7.2.*
`7.3-rc2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6c601410d1a9ae645f604fe2f61b9f4942c77dfb)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,2df8f7720ed91f1aad4f128553b6e90c7c5fac1e)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,67c6726dd6048a2781aa43a2bf9fcf1e16ee3a7d)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,553c375e86a49882e95840565512e17bff31cc3a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8c38049879f2108f57c98f03cc7f3db51a12bdab)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,838455cc8bfe1278150d1d776529edea6cd4c1dd)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e22428f0c038c23109c0383a235aa607b0cd4c95)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,2430eb81e44111b30eeb5273bbcf8b24ca517ef9)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[5.10.270,5.10.*]`	unaffected	semver	—
`[5.15.221,5.15.*]`	unaffected	semver	—
`[6.1.188,6.1.*]`	unaffected	semver	—
`[6.6.157,6.6.*]`	unaffected	semver	—
`[6.12.110,6.12.*]`	unaffected	semver	—
`[6.18.51,6.18.*]`	unaffected	semver	—
`[7.2.5,7.2.*]`	unaffected	semver	—
`[7.3-rc2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update your Linux kernel to a version that includes the USB MDC800 driver patch.
If an upgrade is not possible, disable the usb_mdc800 driver or remove the device to prevent any interaction.
Limit who can load or interact with the usb_mdc800 driver, for example by applying kernel module parameter restrictions.
Monitor kernel logs for anomalous USB activity and consider enforcing SELinux or AppArmor policies to constrain USB drivers.

Generated by OpenCVE AI on September 18, 2026 at 04:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2430eb81e44111b30eeb5273bbcf8b24ca517ef9
https://git.kernel.org/stable/c/2df8f7720ed91f1aad4f128553b6e90c7c5fac1e
https://git.kernel.org/stable/c/553c375e86a49882e95840565512e17bff31cc3a
https://git.kernel.org/stable/c/67c6726dd6048a2781aa43a2bf9fcf1e16ee3a7d
https://git.kernel.org/stable/c/6c601410d1a9ae645f604fe2f61b9f4942c77dfb
https://git.kernel.org/stable/c/838455cc8bfe1278150d1d776529edea6cd4c1dd
https://git.kernel.org/stable/c/8c38049879f2108f57c98f03cc7f3db51a12bdab
https://git.kernel.org/stable/c/e22428f0c038c23109c0383a235aa607b0cd4c95

History

Fri, 18 Sep 2026 04:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-200

Wed, 16 Sep 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: image: mdc800: change kmalloc() to kzalloc() Change the kmalloc() calls in usb_mdc800_init() for irq_urb_buffer and download_urb_buffer to kzalloc(), avoiding potential stack leaks if a shorter message is received in mdc800_usb_irq() and mdc800_usb_download_notify()
Title		usb: image: mdc800: change kmalloc() to kzalloc()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2430eb81e44111b30eeb5273bbcf8b24ca517ef9 https://git.kernel.org/stable/c/2df8f7720ed91f1aad4f128553b6e90c7c5fac1e https://git.kernel.org/stable/c/553c375e86a49882e95840565512e17bff31cc3a https://git.kernel.org/stable/c/67c6726dd6048a2781aa43a2bf9fcf1e16ee3a7d https://git.kernel.org/stable/c/6c601410d1a9ae645f604fe2f61b9f4942c77dfb https://git.kernel.org/stable/c/838455cc8bfe1278150d1d776529edea6cd4c1dd https://git.kernel.org/stable/c/8c38049879f2108f57c98f03cc7f3db51a12bdab https://git.kernel.org/stable/c/e22428f0c038c23109c0383a235aa607b0cd4c95

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-16T10:33:34.586Z

Updated: 2026-09-17T09:29:28.837Z

Reserved: 2026-09-11T19:38:34.782Z

Link: CVE-2026-90034

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-16T11:17:16.567

Modified: 2026-09-17T10:17:06.167

Link: CVE-2026-90034

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-18T19:30:12Z

Weaknesses

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object