CVE-2026-46151

A flaw was found in the Linux kernel's USB printer (usblp) driver. A malicious USB printer can exploit a heap leak vulnerability by sending a truncated device ID response. This can lead to the disclosure of up to 1021 bytes of uninitialized kernel memory, potentially exposing sensitive information to an attacker.

usblp cached the IEEE 1284 device ID in a kmalloc buffer and trusted the two byte length prefix even when the USB control transfer completed short. A malicious or malformed USB printer can return only the length prefix and cause the driver to expose stale heap bytes through the ieee1284_id sysfs attribute or the IOCNR_GET_DEVICE_ID ioctl. For the CVSS the PR:L is used for the paranoid score because a local user needs access to the usblp device node or sysfs data path, or an equivalent USB passthrough context. The main attack model is physical or local USB device access, not network reachability. Impact is kernel information disclosure only, up to roughly 1021 bytes per affected ID read, with no supported write primitive or privilege escalation path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.