In the Linux kernel, the following vulnerability has been resolved:

usb: image: mdc800: change kmalloc() to kzalloc()

Change the kmalloc() calls in usb_mdc800_init() for irq_urb_buffer and
download_urb_buffer to kzalloc(), avoiding potential stack leaks if a
shorter message is received in mdc800_usb_irq() and
mdc800_usb_download_notify()

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00201.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 6c601410d1a9ae645f604fe2f61b9f4942c77dfb
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 2df8f7720ed91f1aad4f128553b6e90c7c5fac1e
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 67c6726dd6048a2781aa43a2bf9fcf1e16ee3a7d
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 553c375e86a49882e95840565512e17bff31cc3a
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 8c38049879f2108f57c98f03cc7f3db51a12bdab
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 838455cc8bfe1278150d1d776529edea6cd4c1dd
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < e22428f0c038c23109c0383a235aa607b0cd4c95
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 2430eb81e44111b30eeb5273bbcf8b24ca517ef9
Linux Linux affected
Version Status Constraints
2.6.12 affected —
0 unaffected < 2.6.12
5.10.270 unaffected ≤ 5.10.*
5.15.221 unaffected ≤ 5.15.*
6.1.188 unaffected ≤ 6.1.*
6.6.157 unaffected ≤ 6.6.*
6.12.110 unaffected ≤ 6.12.*
6.18.51 unaffected ≤ 6.18.*
7.2.5 unaffected ≤ 7.2.*
7.3 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-4817-1 linux-6.12 security update
Debian DLA Debian DLA DLA-4841-1 linux security update
Debian DSA Debian DSA DSA-6528-1 linux security update
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/2430eb81e44111b30eeb5273bbcf8b24ca517ef9 cve-icon cve-icon
https://git.kernel.org/stable/c/2df8f7720ed91f1aad4f128553b6e90c7c5fac1e cve-icon cve-icon
https://git.kernel.org/stable/c/553c375e86a49882e95840565512e17bff31cc3a cve-icon cve-icon
https://git.kernel.org/stable/c/67c6726dd6048a2781aa43a2bf9fcf1e16ee3a7d cve-icon cve-icon
https://git.kernel.org/stable/c/6c601410d1a9ae645f604fe2f61b9f4942c77dfb cve-icon cve-icon
https://git.kernel.org/stable/c/838455cc8bfe1278150d1d776529edea6cd4c1dd cve-icon cve-icon
https://git.kernel.org/stable/c/8c38049879f2108f57c98f03cc7f3db51a12bdab cve-icon cve-icon
https://git.kernel.org/stable/c/e22428f0c038c23109c0383a235aa607b0cd4c95 cve-icon cve-icon
History

Fri, 18 Sep 2026 04:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Wed, 16 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: usb: image: mdc800: change kmalloc() to kzalloc() Change the kmalloc() calls in usb_mdc800_init() for irq_urb_buffer and download_urb_buffer to kzalloc(), avoiding potential stack leaks if a shorter message is received in mdc800_usb_irq() and mdc800_usb_download_notify()
Title usb: image: mdc800: change kmalloc() to kzalloc()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-19T08:56:51.238Z

Reserved: 2026-09-11T19:38:34.782Z

Link: CVE-2026-90034

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-16T11:17:16.567

Modified: 2026-10-19T09:18:51.600

Link: CVE-2026-90034

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-18T19:30:12Z

Weaknesses