Linux Kernel Vulnerability in USB Image: MDC800 Affecting Various Versions

CVE-2026-90034

What is CVE-2026-90034?

A vulnerability has been identified in the Linux kernel related to the USB MDC800 driver, specifically in the handling of memory allocation. The issue arises from the use of kmalloc() for initializing the irq_urb_buffer and download_urb_buffer, which could lead to potential stack information leaks when shorter messages are processed in the mdc800_usb_irq() and mdc800_usb_download_notify() functions. By changing kmalloc() to kzalloc(), the risk of sensitive data being exposed in stack memory is mitigated, enhancing overall system security.

References