The kernel’s sierra_ms storage driver performs a user‑defined GetSwocInfo request for 60 bytes, but its callers only treat a negative return value as failure. When a device supplies a short IN transfer, the remaining portion of the freshly allocated (kmalloc, non‑zeroed) buffer stays uninitialized. The truinst sysfs attribute then outputs fields from that buffer, allowing an unprivileged user to read up to five bytes of legacy kernel heap memory each time the attribute is read. All data leaks come from stale kernel space and can be accessed by any process that can read the truinst file. This represents an information‑disclosure vulnerability that does not grant additional privileges.

All Linux kernel installations that include the sierra_ms USB storage driver are affected; the exact kernel version is not specified, so any kernel compiled with this module before the patch is vulnerable. No specific vendor‑product names beyond the generic Linux kernel are listed.

The risk derives from local privilege: an attacker only needs to present a malicious USB device that responds to the GetSwocInfo request with an incomplete transfer. No authentication or elevated rights are required. The CVSS score is 3.3, indicating low severity. The EPSS score is < 1%, indicating a very low likelihood of exploitation, and the vulnerability is not in the CISA KEV catalog. Exploitation is straightforward—plug in the device, read the truinst attribute, and observe leaked kernel data. Repeatable reads allow accumulation of additional memory snapshots. Because the exposed data is from heap memory, its contents vary over time, but any sensitive information residing on the heap could be exposed.