CVE-2026-80595: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80595 Overview

CVE-2026-80595 affects the Linux kernel ims-pcu input driver. The driver processes response data received from USB device buffers without confirming the device sent enough bytes to satisfy the expected response length. An attacker with control over a malicious or malfunctioning USB device can trigger out-of-bounds reads or cause the driver to process stale data from prior transactions.

The upstream fix adds explicit response length checks before the driver dereferences fields in the response buffer. Multiple stable kernel branches received backported patches.

Critical Impact
A malicious USB device can trigger out-of-bounds reads in the kernel ims-pcu driver, leading to information disclosure or processing of stale buffer contents.

Affected Products

Linux kernel drivers/input/misc/ims-pcu.c prior to the fix commits
Multiple stable kernel branches (backports referenced in kernel.org commits)
Systems that load the ims-pcu module when an IMS Passenger Control Unit USB device is attached

Discovery Timeline

2026-08-28 - CVE-2026-80595 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80595

Vulnerability Analysis

The ims-pcu driver in the Linux kernel handles USB input devices from IMS (Innovative Manufacturing Services) Passenger Control Units. The driver issues command requests to the device and then parses the response data returned in USB transfer buffers.

Before the patch, the driver accessed fields inside the response buffer without validating that the actual transfer length matched the minimum required size for that response type. When a device returned a short transfer, the driver read memory beyond the valid response data. This condition maps to Out-of-Bounds Read [CWE-125] and can also expose stale content from previous transfers still resident in the buffer.

Root Cause

The driver trusted the response layout without checking actual_length from the URB (USB Request Block). Response handlers indexed into buffer offsets assuming a full-size response, producing reads past the valid data window. Stale bytes from earlier transactions could be interpreted as valid protocol fields, causing incorrect state transitions within the driver.

Attack Vector

Exploitation requires an attacker-controlled USB device or a physically attached device that returns undersized responses to ims-pcu commands. The attacker crafts responses shorter than the driver expects, triggering reads of adjacent kernel memory. Because USB input drivers auto-load through hotplug, a plugged-in malicious device is sufficient to reach the vulnerable code path.

No exploitation code is available. For technical detail on the fix, see the upstream commits: Kernel Git Commit f3c63aec, Kernel Git Commit 89cf4d18, and Kernel Git Commit f7f5afe.

Detection Methods for CVE-2026-80595

Indicators of Compromise

Kernel log entries referencing the ims-pcu driver with unexpected parsing errors or short-transfer warnings
Unexplained USB device enumeration events for IMS Passenger Control Unit vendor/product identifiers on hosts not expected to use such hardware
KASAN (Kernel Address Sanitizer) reports flagging out-of-bounds reads in ims-pcu response handlers on instrumented kernels

Detection Strategies

Compare running kernel version against the fixed commit hashes (f3c63aec, 89cf4d18, f7f5afe, bbafb75, dc9fdb53, 48c9d92, 3e0e8d7, f28c5cab) or the corresponding distribution security update
Audit which hosts load the ims-pcu kernel module through lsmod and configuration management inventory
Monitor USB hotplug telemetry for unauthorized devices matching the ims-pcu driver binding table

Monitoring Recommendations

Forward dmesg and journalctl -k output to a central log store and alert on new ims-pcu binding events
Enable USB device policy controls (for example, usbguard) to restrict which USB device classes and IDs may bind on servers and workstations
Track kernel package versions across the fleet to confirm the patch is deployed on every affected host

How to Mitigate CVE-2026-80595

Immediate Actions Required

Apply the vendor-supplied kernel update from your Linux distribution that includes the referenced upstream commits
Reboot systems after installing the updated kernel so the patched code path is active
If patching is delayed, blocklist the ims-pcu module on hosts that do not require the hardware

Patch Information

The fix adds response length validation in the ims-pcu driver. It is present in the mainline commit f3c63aec with backports to stable branches at 89cf4d18, f7f5afe, bbafb75, dc9fdb53, 48c9d92, 3e0e8d7, and f28c5cab.

Workarounds

Blocklist the module by adding blacklist ims-pcu to /etc/modprobe.d/blacklist-ims-pcu.conf on systems that do not use IMS hardware
Restrict physical and logical USB access on servers and workstations, and enforce USB device allowlists with usbguard
Where feasible, disable auto-loading of unused input drivers by removing them from the initramfs

bash

# Blocklist the ims-pcu module and refresh initramfs
echo 'blacklist ims-pcu' | sudo tee /etc/modprobe.d/blacklist-ims-pcu.conf
sudo depmod -a
sudo update-initramfs -u

# Verify the module is not loaded after reboot
lsmod | grep ims_pcu