CVE-2026-64565: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64565 Overview

CVE-2026-64565 is a heap buffer overflow vulnerability in the Linux kernel's ims-pcu input driver. The flaw resides in the ims_pcu_process_data() function, which processes incoming USB Request Block (URB) data byte by byte without validating the read_pos index against IMS_PCU_BUF_SIZE. A malicious USB device can send an oversized packet, causing read_pos to increment past the buffer boundary. Because read_pos is located immediately after read_buf in memory, an attacker can overwrite read_pos itself and gain arbitrary control over the write index. The manipulated index is later used in ims_pcu_handle_response() to copy data into cmd_buf, enabling heap corruption and control-flow hijack.

Critical Impact
A physically present attacker with a malicious USB device can trigger heap corruption and potentially achieve kernel-level control-flow hijack through the complete(&pcu->cmd_done) call.

Affected Products

Linux kernel versions containing the ims-pcu driver prior to the referenced stable patch commits
Systems that load the ims_pcu input driver module
Distributions shipping vulnerable stable kernel branches until backports are applied

Discovery Timeline

2026-08-04 - CVE-2026-64565 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-64565

Vulnerability Analysis

The ims_pcu_process_data() function parses URB payloads one byte at a time into the driver's read_buf structure. The function increments read_pos on each byte written but never checks whether read_pos has reached the size of the destination buffer defined by IMS_PCU_BUF_SIZE. This missing bounds check turns an untrusted USB packet length into an unbounded write index.

The layout of the surrounding structure amplifies the impact. The read_pos counter sits immediately after read_buf in memory. Once a write extends past the buffer, the next iterations overwrite read_pos itself, giving the attacker direct control over the write index for subsequent bytes.

After parsing completes, ims_pcu_handle_response() uses the attacker-controlled read_pos when copying data into cmd_buf. This produces a heap buffer overflow that reaches the cmd_done.wait.head list pointer located at offset 136 relative to cmd_buf. When the driver subsequently invokes complete(&pcu->cmd_done), the kernel dereferences the corrupted list pointer, giving the attacker a control-flow hijack primitive in kernel context.

Root Cause

The root cause is missing input validation in a USB packet parser. ims_pcu_process_data() trusts the length of data delivered by the USB device and does not enforce that read_pos < IMS_PCU_BUF_SIZE before writing into read_buf. The adjacency of read_pos and read_buf converts a simple out-of-bounds write into an index-controlled arbitrary offset write.

Attack Vector

Exploitation requires a malicious or attacker-controlled USB device claiming to be an IMS PCU input device. When plugged into a target system, the device transmits a URB payload larger than IMS_PCU_BUF_SIZE. Continued writes overwrite read_pos, then the follow-on response handler corrupts the cmd_done completion structure. The subsequent complete() call operates on a manipulated waitqueue head, enabling kernel control-flow hijack. The vulnerability is triggered without user interaction beyond attaching the USB device.

No verified public exploit code is available. See the referenced kernel commit for the corrective patch that adds the missing bounds check.

Detection Methods for CVE-2026-64565

Indicators of Compromise

Kernel warnings or oops messages referencing ims_pcu_process_data, ims_pcu_handle_response, or complete on cmd_done
Unexpected loading of the ims_pcu module on hosts that do not use IMS PCU hardware
USB device enumeration events for IMS PCU vendor and product identifiers on servers, kiosks, or endpoints that should not accept such peripherals

Detection Strategies

Monitor dmesg and journald for ims-pcu driver warnings, particularly the new packet-too-long warning introduced by the patch
Alert on kernel panics or GPFs whose backtrace includes ims_pcu_handle_response or the complete() path following USB device insertion
Correlate USB udev events with kernel error output to catch malicious device plug-in attempts targeting the driver

Monitoring Recommendations

Ingest kernel logs and udev events into a centralized log platform and build detections around ims_pcu string matches
Track module load events for ims_pcu on systems that have no legitimate need for the driver
Baseline authorized USB vendor and product identifiers per host class and alert on deviations

How to Mitigate CVE-2026-64565

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the NVD entry as soon as vendor builds are available
Blacklist the ims_pcu module on systems that do not require IMS PCU hardware by adding it to modprobe blacklist configuration
Enforce USB device control policies to block unknown or unauthorized USB peripherals from being enumerated

Patch Information

The fix adds a bounds check for read_pos before writing into read_buf, discards oversized packets, logs a warning, and resets the parser state including the checksum. Corrective commits are available in the stable tree: 40bbbf2e91fd, 875115b82c29, ca9f8c09845f, and d03a740e087d.

Workarounds

Blacklist the ims_pcu kernel module until patched kernels are deployed
Restrict physical access to USB ports on high-value systems and disable USB autoloading of input drivers where policy allows
Deploy USB device authorization policies using the usbguard framework or equivalent to reject unauthorized devices at enumeration time

bash

# Blacklist the vulnerable module until patched kernels are installed
echo "blacklist ims_pcu" | sudo tee /etc/modprobe.d/blacklist-ims-pcu.conf
sudo depmod -a
sudo update-initramfs -u

# Verify the module is not loaded
lsmod | grep ims_pcu