CVE-2026-80596: Linux Kernel Input Driver DOS Vulnerability

CVE-2026-80596 Overview

CVE-2026-80596 is a Linux kernel vulnerability in the ims-pcu input driver. The driver exposes sysfs attributes on all USB interfaces it binds to, including the secondary data interface. Only the primary control interface supports these attributes. Accessing the attributes on a data interface can trigger unexpected behavior or a kernel crash because the data interface lacks the required descriptors and internal state.

The flaw was introduced when the driver was converted to use the driver core to instantiate device attributes via the .dev_groups field in the usb_driver structure. The fix updates the is_visible() callbacks for the main and OFN attribute groups to confirm the target interface is the control interface.

Critical Impact
Local access to affected sysfs attributes on the ims-pcu data interface can crash the kernel or produce undefined behavior.

Affected Products

Linux kernel — drivers/input/misc/ims-pcu.c (ims-pcu driver)
Stable branches receiving backports referenced in 001428ea4d, 73e6687be0, 7d5e7c8d48, and 87e2f89dea
Systems with an IMS PCU USB device bound to the driver

Discovery Timeline

2026-08-28 - CVE-2026-80596 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80596

Vulnerability Analysis

The ims-pcu driver supports IMS Passenger Control Unit USB devices. It exposes device attributes through sysfs for management and diagnostics. Historically, these attributes were registered manually against the control interface only. The migration to the driver core model shifted attribute creation to .dev_groups on the usb_driver structure.

Because the driver claims the secondary data interface during probe, the driver core creates the same sysfs attributes on that second interface. Reads and writes against those attributes reach handlers that expect the control interface state. The handlers dereference descriptors and buffers that were never initialized for the data interface. This leads to invalid memory access and potential kernel crashes.

The issue is classified as a kernel driver flaw with local attack vector characteristics. Exploitation requires local access to the sysfs attribute files on an affected system.

Root Cause

The root cause is missing interface validation in the attribute group visibility logic. The is_visible() callbacks did not distinguish between the control interface and the claimed data interface. Both received the full attribute set even though only one has the supporting state.

Attack Vector

A local user with permission to access sysfs entries for the ims-pcu device can trigger the flaw by reading or writing attributes exposed on the data interface. The corrective patches, tracked by kernel commits 001428ea4d, 73e6687be0, 7d5e7c8d48, and 87e2f89dea, add an interface check inside the is_visible() callbacks so that attributes are only surfaced on the control interface.

No public proof-of-concept exploit or in-the-wild exploitation has been reported. See the Kernel Change 001428ea4d and Kernel Change 87e2f89dea commits for the exact code changes.

Detection Methods for CVE-2026-80596

Indicators of Compromise

Kernel oops or panic messages referencing ims_pcu symbols in dmesg or /var/log/kern.log.
Unexpected process termination or hangs during interaction with /sys/bus/usb/drivers/ims_pcu/ attribute files.
Presence of an IMS PCU USB device bound to the ims-pcu driver on an unpatched kernel.

Detection Strategies

Inventory running kernel versions and compare against the fixed commits 001428ea4d, 73e6687be0, 7d5e7c8d48, and 87e2f89dea to identify unpatched hosts.
Audit sysfs access attempts against USB interface directories for the ims-pcu driver using auditd rules on /sys/bus/usb/devices/.
Monitor kernel crash telemetry for stack traces containing ims_pcu functions.

Monitoring Recommendations

Forward dmesg and kernel logs to a centralized log platform and alert on ims-pcu related faults.
Track USB device enumeration events to identify hosts with IMS PCU hardware attached.
Correlate local user activity with sysfs access patterns to flag unusual attribute reads or writes.

How to Mitigate CVE-2026-80596

Immediate Actions Required

Apply the stable kernel update that includes commits 001428ea4d, 73e6687be0, 7d5e7c8d48, and 87e2f89dea.
Restrict local shell access on systems that use IMS PCU hardware until patched.
Confirm patch inclusion by inspecting the is_visible() callbacks in drivers/input/misc/ims-pcu.c.

Patch Information

The fix is present in the mainline and stable Linux kernel trees. Refer to the upstream commits: Kernel Change 001428ea4d, Kernel Change 73e6687be0, Kernel Change 7d5e7c8d48, and Kernel Change 87e2f89dea. Rebuild and reboot after installing the updated kernel package from your distribution.

Workarounds

Blacklist the ims_pcu kernel module on systems that do not require IMS PCU functionality.
Physically remove or leave unplugged IMS PCU USB devices until patched kernels are deployed.
Tighten filesystem permissions on /sys/bus/usb/drivers/ims_pcu/ to prevent unprivileged sysfs reads and writes.

bash

# Blacklist the ims-pcu module until the kernel is patched
echo 'blacklist ims_pcu' | sudo tee /etc/modprobe.d/blacklist-ims-pcu.conf
sudo rmmod ims_pcu 2>/dev/null
sudo update-initramfs -u