CVE-2026-72078 Input: ims-pcu - validate control endpoint type

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - validate control endpoint type The driver currently assumes that the first endpoint of the control interface is an interrupt IN endpoint without verifying it. A malicious device could provide a different endpoint...

EUVD-2026-59035

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix firmware leak in async update The firmware object was not being released if validation failed. Use freefirmware to ensure the firmware is always released...

CVE-2026-72077

CVE-2026-72077 pertains to the Linux kernel. The issue is a firmware leak in the ims-pcu path during async firmware update: when validation fails, the firmware object was not released. The fix ensures the firmware is always released by calling __free(firmware). This is a kernel memory/resource le...

CVE-2026-72077 Input: ims-pcu - fix firmware leak in async update

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix firmware leak in async update The firmware object was not being released if validation failed. Use freefirmware to ensure the firmware is always released...

CVE-2026-72077 Input: ims-pcu - fix firmware leak in async update

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix firmware leak in async update The firmware object was not being released if validation failed. Use freefirmware to ensure the firmware is always released...

CVE-2026-72075

In the Linux kernel, a race condition was fixed in the ims-pcu reset_device sysfs callback. The ims_pcu_reset_device() path called IMS_PCU_execute_command() without holding pcu->cmd_mutex, allowing data races and possible corruption of the shared command buffer when commands execute concurrent...

CVE-2026-72076 Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix out-of-bounds read in imspcuirq debug logging The debug logging in imspcuirq unconditionally prints data from pcu-urbinbuf. However, if the interrupt fired for pcu-urbctrl, the actual data resides in...

EUVD-2026-59034

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix out-of-bounds read in imspcuirq debug logging The debug logging in imspcuirq unconditionally prints data from pcu-urbinbuf. However, if the interrupt fired for pcu-urbctrl, the actual data resides in...

CVE-2026-72075 Input: ims-pcu - fix race condition in reset_device sysfs callback

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix race condition in resetdevice sysfs callback The imspcuresetdevice sysfs callback calls imspcuexecutecommand without acquiring pcu-cmdmutex. This can lead to data races and corruption of the shared command...

EUVD-2026-59033

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix race condition in resetdevice sysfs callback The imspcuresetdevice sysfs callback calls imspcuexecutecommand without acquiring pcu-cmdmutex. This can lead to data races and corruption of the shared command...

CVE-2026-72075 Input: ims-pcu - fix race condition in reset_device sysfs callback

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix race condition in resetdevice sysfs callback The imspcuresetdevice sysfs callback calls imspcuexecutecommand without acquiring pcu-cmdmutex. This can lead to data races and corruption of the shared command...

CVE-2026-72076 Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix out-of-bounds read in imspcuirq debug logging The debug logging in imspcuirq unconditionally prints data from pcu-urbinbuf. However, if the interrupt fired for pcu-urbctrl, the actual data resides in...

CVE-2026-72074 Input: ims-pcu - fix type confusion in CDC union descriptor parsing

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix type confusion in CDC union descriptor parsing The driver currently trusts the bMasterInterface0 from the CDC union descriptor without verifying that it matches the interface being probed. This could lead to...

CVE-2026-72074

The CVE-2026-72074 entry concerns a Linux kernel USB IMS-PCU driver issue where the bMasterInterface0 from the CDC union descriptor is trusted without verifying it matches the interface being probed. This type confusion in CDC descriptor parsing could allow the driver to overwrite private data of...

CVE-2026-72074 Input: ims-pcu - fix type confusion in CDC union descriptor parsing

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix type confusion in CDC union descriptor parsing The driver currently trusts the bMasterInterface0 from the CDC union descriptor without verifying that it matches the interface being probed. This could lead to...

EUVD-2026-59032

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix type confusion in CDC union descriptor parsing The driver currently trusts the bMasterInterface0 from the CDC union descriptor without verifying that it matches the interface being probed. This could lead to...

CVE-2026-72079: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix use-after-free and double-free in disconnect imspcudisconnect only intended to perform cleanup when the primary control interface is unbound. However, it currently relies on the interface class to distinguish...

CVE-2026-72076: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix out-of-bounds read in imspcuirq debug logging The debug logging in imspcuirq unconditionally prints data from pcu-urbinbuf. However, if the interrupt fired for pcu-urbctrl, the actual data resides in...

PT-2026-72268

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free and double-free issue exists in the ims pcu disconnect function. The function is designed to perform cleanup only when the primary control interface is unbound, but it...

PT-2026-72264

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the ims pcu reset device sysfs callback. The issue occurs because the callback invokes the ims pcu execute command function without acquiring the pcu-cmd mutex...