CVE-2026-72078

Input: ims-pcu - validate control endpoint type

State: Published
Severity: Not scored
Published: Aug 15, 2026
Updated: Aug 17, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Input: ims-pcu - validate control endpoint type

The driver currently assumes that the first endpoint of the control interface is an interrupt IN endpoint without verifying it. A malicious device could provide a different endpoint type, which would then be passed to usb_fill_int_urb(), potentially leading to kernel warnings or undefined behavior.

Verify that the control endpoint is an interrupt IN endpoint.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	628329d52474323938a03826941e166bc7c8eff4 to before 5de5075a1f26166f172b6687cb66810a9b61e3ebAffected 628329d52474323938a03826941e166bc7c8eff4 to before 7960d99332e03705ec622d92f31e0c77de8baac6Affected 628329d52474323938a03826941e166bc7c8eff4 to before 5b96b4da96313dd799a3a40dcfd598d2e2c19217Affected 628329d52474323938a03826941e166bc7c8eff4 to before aa1885f87e60c80e59e50ffd5fb096bf02c83e05Affected 628329d52474323938a03826941e166bc7c8eff4 to before a630508a09b0c05f14bc0843ed409221a93751aaAffected 628329d52474323938a03826941e166bc7c8eff4 to before c8d3d83f2eaaf7659de76e8d44e8fc88ee346042Affected 628329d52474323938a03826941e166bc7c8eff4 to before cbfa059dfb48b9aa322e34fd44a093d9ca29ad7eAffected 628329d52474323938a03826941e166bc7c8eff4 to before baf56975806534268e24acf9a8abb1c447ce11e9Affected
LinuxLinux	3.10Affected before 3.10Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

628329d52474323938a03826941e166bc7c8eff4 to before 5de5075a1f26166f172b6687cb66810a9b61e3ebAffected
628329d52474323938a03826941e166bc7c8eff4 to before 7960d99332e03705ec622d92f31e0c77de8baac6Affected
628329d52474323938a03826941e166bc7c8eff4 to before 5b96b4da96313dd799a3a40dcfd598d2e2c19217Affected
628329d52474323938a03826941e166bc7c8eff4 to before aa1885f87e60c80e59e50ffd5fb096bf02c83e05Affected
628329d52474323938a03826941e166bc7c8eff4 to before a630508a09b0c05f14bc0843ed409221a93751aaAffected
628329d52474323938a03826941e166bc7c8eff4 to before c8d3d83f2eaaf7659de76e8d44e8fc88ee346042Affected
628329d52474323938a03826941e166bc7c8eff4 to before cbfa059dfb48b9aa322e34fd44a093d9ca29ad7eAffected
628329d52474323938a03826941e166bc7c8eff4 to before baf56975806534268e24acf9a8abb1c447ce11e9Affected

LinuxLinux

3.10Affected
before 3.10Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.