CVE-2026-80594: Linux Kernel ims-pcu DOS Vulnerability

CVE-2026-80594 Overview

CVE-2026-80594 is a denial-of-service vulnerability in the Linux kernel ims-pcu input driver. The flaw resides in ims_pcu_get_cdc_union_desc(), which parses Communications Device Class (CDC) union descriptors by iterating through extra descriptor data. The driver fails to validate that each descriptor's bLength field is at least 2 bytes. A malicious USB device that advertises a descriptor with bLength = 0 causes the parsing loop to never advance, producing an infinite loop in kernel context.

Critical Impact
A crafted USB device attached to a vulnerable host can hang the kernel through an infinite descriptor-parsing loop, resulting in denial of service.

Affected Products

Linux kernel ims-pcu input driver (upstream)
Stable kernel branches receiving the backported fix commits
Distributions shipping kernels prior to the referenced patch commits

Discovery Timeline

2026-08-28 - CVE-2026-80594 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80594

Vulnerability Analysis

The ims-pcu driver supports IMS Presentation Control Unit devices over USB. During initialization, it walks the extra descriptor buffer returned by the device to locate a CDC union functional descriptor. The parser advances its pointer by the value of the bLength field on each iteration.

When a device reports bLength = 0, the pointer never advances and the loop condition remains satisfied indefinitely. The kernel thread executing the USB probe path enters an unbounded loop, consuming CPU and potentially blocking further USB or driver activity. This behavior falls under the Infinite Loop denial-of-service class.

Root Cause

The root cause is missing input validation on device-supplied data. USB descriptors are attacker-controlled when a malicious or physically attached device negotiates with the host. The ims_pcu_get_cdc_union_desc() function trusted the bLength field without enforcing the CDC specification minimum of 2 bytes. The fix adds an explicit check that rejects descriptors with bLength < 2 before continuing the walk.

Attack Vector

Exploitation requires the ability to attach a USB device, either physically or through a virtualized USB pass-through interface, to a system running a vulnerable kernel with the ims-pcu driver present. The malicious device advertises a matching IMS PCU identifier and returns a crafted configuration descriptor containing a functional descriptor with bLength = 0. When the driver probes the device, the kernel enters the infinite loop. No authentication or user interaction beyond device attachment is required.

No verified exploit code is publicly available. The vulnerability is described in prose in the upstream commit messages referenced below.

Detection Methods for CVE-2026-80594

Indicators of Compromise

Kernel worker threads or khubd/USB probe threads pegged at 100% CPU shortly after a USB device attachment event.
dmesg entries showing ims-pcu probe activity followed by system unresponsiveness or soft lockup warnings.
Unexpected USB device enumeration events involving IMS PCU vendor and product identifiers on hosts that do not normally use such hardware.

Detection Strategies

Inventory running kernel versions across Linux fleets and correlate against the fixed commits listed in the patch section.
Monitor udev and kernel logs for repeated probe failures or long-running probes associated with the ims-pcu module.
Audit which endpoints have the ims-pcu module loaded or auto-loadable, and flag hosts that expose USB ports to untrusted users.

Monitoring Recommendations

Alert on soft lockup and RCU stall messages produced by the kernel, which frequently accompany infinite-loop conditions.
Track USB device attachment events centrally and correlate with subsequent CPU or availability anomalies on the same host.
Use endpoint telemetry to detect unauthorized USB device classes attached to servers, kiosks, and shared workstations.

How to Mitigate CVE-2026-80594

Immediate Actions Required

Apply the vendor-supplied kernel update that includes the ims_pcu_get_cdc_union_desc()bLength validation fix.
Where patching is delayed, blacklist the ims-pcu kernel module on systems that do not require IMS PCU hardware.
Restrict physical and virtual USB access on servers, kiosks, and any host handling untrusted peripherals.

Patch Information

The fix has been merged upstream and backported to stable branches. Relevant commits include Kernel Patch Commit 383934c, Kernel Patch Commit 6314bd9, Kernel Patch Commit 67a038c, Kernel Patch Commit 76eeeb3, Kernel Patch Commit b847f27, Kernel Patch Commit bbbe314, Kernel Patch Commit d4579af, and Kernel Patch Commit e3f93d6. Consume the fix by upgrading to a distribution kernel that incorporates one of these commits.

Workarounds

Add blacklist ims_pcu to /etc/modprobe.d/ on hosts that do not require the driver, and rebuild the initramfs.
Enforce USB device authorization policies using usbguard or the kernel authorized_default sysfs interface to block unknown devices.
Physically restrict USB port access on production servers and disable unused USB controllers in firmware where feasible.

bash

# Configuration example: disable the ims-pcu driver until patched
echo 'blacklist ims_pcu' | sudo tee /etc/modprobe.d/blacklist-ims-pcu.conf
sudo depmod -a
sudo update-initramfs -u   # Debian/Ubuntu
# or: sudo dracut -f      # RHEL/Fedora/openSUSE