SB2026080476 - Heap-based buffer overflow in Linux kernel input misc driver

Description

This security bulletin contains information about 1 vulnerability.

1) Heap-based buffer overflow (CVE-ID: CVE-2026-64565)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in ims_pcu_handle_response() when processing oversized packets from a malicious USB device. An attacker with physical access can send a specially crafted oversized USB packet to execute arbitrary code.

The issue arises because ims_pcu_process_data() does not properly bound-check read_pos, allowing it to be overwritten and later used as a controlled index during response handling.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/40bbbf2e91fd60715525bf0405c67876af817edf
• https://git.kernel.org/stable/c/875115b82c295277b81b6dfee7debc725f44e854
• https://git.kernel.org/stable/c/ca9f8c09845fb8c51b6d447f6428eecd1b8b0a49
• https://git.kernel.org/stable/c/d03a740e087de7dcb2a26dc1123377bd3d1d84ca