PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2026-46167

CVE-2026-46167

kernel: usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl

Loading…

Severity

Low

Red Hat Product Security

5.5

CVSS 3.1

Review impact separately from score.

Published · May 28, 2026

Updated · July 3, 2026

Description

A flaw was found in the Linux kernel's usblp driver. A local user, interacting with a malicious printer, could exploit this vulnerability. When the LPGETSTATUS ioctl is used and a printer responds with zero bytes, the driver may return uninitialized kernel memory. This leads to information disclosure, potentially exposing sensitive data from the kernel's heap.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-824 · Access of Uninitialized Pointer