CVE-2026-80596 (GCVE-0-2026-80596)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:48 – Updated: 2026-08-29 06:21
VLAI
Title
Input: ims-pcu - only expose sysfs attributes on control interface
Summary
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - only expose sysfs attributes on control interface When the driver was converted to use the driver core to instantiate device attributes (via .dev_groups in the usb_driver structure), the attributes started appearing on all interfaces bound to the driver. Since the ims-pcu driver manually claims the secondary data interface during probe, the driver core automatically creates the sysfs attributes for that interface as well. However, the driver only supports these attributes on the primary control interface. Data interfaces lack the necessary descriptors and internal state to handle these requests, and accessing them can lead to unexpected behavior or crashes. Fix this by updating the is_visible() callbacks for both the main and OFN attribute groups to verify that the interface being accessed is indeed the control interface.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 204d18a7a0c67352857dee1bbac517ed63f01d8e , < 7d5e7c8d48f0aaeb9ec90a9a4f450f3c5e422431 (git)
Affected: 204d18a7a0c67352857dee1bbac517ed63f01d8e , < 87e2f89dea078572fb9e13864cec2b1bd8e89b71 (git)
Affected: 204d18a7a0c67352857dee1bbac517ed63f01d8e , < 73e6687be0c1c323a8ec5b733f29440a93e08ff2 (git)
Affected: 204d18a7a0c67352857dee1bbac517ed63f01d8e , < 001428ea4d2c371107cb984108e266adf99f1f1e (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/misc/ims-pcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7d5e7c8d48f0aaeb9ec90a9a4f450f3c5e422431",
              "status": "affected",
              "version": "204d18a7a0c67352857dee1bbac517ed63f01d8e",
              "versionType": "git"
            },
            {
              "lessThan": "87e2f89dea078572fb9e13864cec2b1bd8e89b71",
              "status": "affected",
              "version": "204d18a7a0c67352857dee1bbac517ed63f01d8e",
              "versionType": "git"
            },
            {
              "lessThan": "73e6687be0c1c323a8ec5b733f29440a93e08ff2",
              "status": "affected",
              "version": "204d18a7a0c67352857dee1bbac517ed63f01d8e",
              "versionType": "git"
            },
            {
              "lessThan": "001428ea4d2c371107cb984108e266adf99f1f1e",
              "status": "affected",
              "version": "204d18a7a0c67352857dee1bbac517ed63f01d8e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/misc/ims-pcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: ims-pcu - only expose sysfs attributes on control interface\n\nWhen the driver was converted to use the driver core to instantiate device\nattributes (via .dev_groups in the usb_driver structure), the attributes\nstarted appearing on all interfaces bound to the driver. Since the ims-pcu\ndriver manually claims the secondary data interface during probe, the\ndriver core automatically creates the sysfs attributes for that interface\nas well.\n\nHowever, the driver only supports these attributes on the primary control\ninterface. Data interfaces lack the necessary descriptors and internal\nstate to handle these requests, and accessing them can lead to unexpected\nbehavior or crashes.\n\nFix this by updating the is_visible() callbacks for both the main and OFN\nattribute groups to verify that the interface being accessed is indeed the\ncontrol interface."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached by local sysfs read(2)/write(2) on ims-pcu driver attributes under /sys/bus/usb/devices/*, flowing through kernfs into ims_pcu_is_attr_visible() and the attribute show/store handlers; exploitation does not require remote network traffic or only plugging a USB cable without OS-level sysfs access.\nAC:L - Once an IMS PCU (or compatible malicious USB gadget) is bound and the data interface exposes the duplicated dev_groups attributes, an attacker can deterministically trigger the fault by reading or writing those sysfs files on the data-interface kobject without races or uncontrollable victim state.\nPR:N - Several exposed attributes are S_IRUGO (world-readable), and sysfs directory listing invokes is_visible() without write privileges; any local user who can read /sys can reach the vulnerable callbacks on the data interface without CAP_SYS_ADMIN or init-namespace root.\nUI:N - No cooperative victim action beyond the attacker performing the sysfs access themselves is required; the attacker does not need another user to mount filesystems, open applications, or perform GUI operations at exploit time.\nS:U - Impact is kernel memory corruption, device reset, or firmware-update misuse within the host OS boundary on systems carrying IMS Passenger Control Units (aircraft seats, kiosks); it enables local privilege escalation but does not cross VM, IOMMU, or hypervisor isolation.\nC:H - Invoking control-only sysfs handlers from the data interface can corrupt shared ims_pcu command/URB state or dereference invalid interface data during is_visible/show paths, giving out-of-bounds reads or kernel pointer exposure beyond a pure NULL crash.\nI:H - Writable sysfs stores (reset_device, update_firmware, OFN register writes) on the wrong interface drive ims_pcu_execute_command() against incompletely initialized USB state, enabling arbitrary device reprogramming and heap corruption primitives exploitable for kernel control-flow hijack.\nA:H - The fix description explicitly cites crashes from accessing data-interface sysfs attributes; malformed command/URB handling and NULL or inconsistent pcu state during teardown can trigger kernel oops, panic, or hung USB I/O on in-service passenger-control and kiosk systems."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:21:08.760Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7d5e7c8d48f0aaeb9ec90a9a4f450f3c5e422431"
        },
        {
          "url": "https://git.kernel.org/stable/c/87e2f89dea078572fb9e13864cec2b1bd8e89b71"
        },
        {
          "url": "https://git.kernel.org/stable/c/73e6687be0c1c323a8ec5b733f29440a93e08ff2"
        },
        {
          "url": "https://git.kernel.org/stable/c/001428ea4d2c371107cb984108e266adf99f1f1e"
        }
      ],
      "title": "Input: ims-pcu - only expose sysfs attributes on control interface",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80596",
    "datePublished": "2026-08-28T06:48:22.892Z",
    "dateReserved": "2026-08-26T14:34:25.770Z",
    "dateUpdated": "2026-08-29T06:21:08.760Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80596",
      "date": "2026-09-01",
      "epss": "0.00144",
      "percentile": "0.03963"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80596\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:43.320\",\"lastModified\":\"2026-08-29T07:16:44.620\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nInput: ims-pcu - only expose sysfs attributes on control interface\\n\\nWhen the driver was converted to use the driver core to instantiate device\\nattributes (via .dev_groups in the usb_driver structure), the attributes\\nstarted appearing on all interfaces bound to the driver. Since the ims-pcu\\ndriver manually claims the secondary data interface during probe, the\\ndriver core automatically creates the sysfs attributes for that interface\\nas well.\\n\\nHowever, the driver only supports these attributes on the primary control\\ninterface. Data interfaces lack the necessary descriptors and internal\\nstate to handle these requests, and accessing them can lead to unexpected\\nbehavior or crashes.\\n\\nFix this by updating the is_visible() callbacks for both the main and OFN\\nattribute groups to verify that the interface being accessed is indeed the\\ncontrol interface.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/input/misc/ims-pcu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"204d18a7a0c67352857dee1bbac517ed63f01d8e\",\"lessThan\":\"7d5e7c8d48f0aaeb9ec90a9a4f450f3c5e422431\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"204d18a7a0c67352857dee1bbac517ed63f01d8e\",\"lessThan\":\"87e2f89dea078572fb9e13864cec2b1bd8e89b71\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"204d18a7a0c67352857dee1bbac517ed63f01d8e\",\"lessThan\":\"73e6687be0c1c323a8ec5b733f29440a93e08ff2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"204d18a7a0c67352857dee1bbac517ed63f01d8e\",\"lessThan\":\"001428ea4d2c371107cb984108e266adf99f1f1e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/input/misc/ims-pcu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/001428ea4d2c371107cb984108e266adf99f1f1e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/73e6687be0c1c323a8ec5b733f29440a93e08ff2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7d5e7c8d48f0aaeb9ec90a9a4f450f3c5e422431\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/87e2f89dea078572fb9e13864cec2b1bd8e89b71\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T16:11:22+00:00",
      "cve": "CVE-2026-80596",
      "id": "CVE-2026-80596",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Input: ims-pcu - only expose sysfs attributes on control interface",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80596.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.