SB20260816455 - Improper input validation in Linux kernel input misc driver
Published: August 16, 2026
Security Bulletin ID
SB20260816455
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Physical access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Improper input validation (CVE-ID: CVE-2026-72078)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to cause a denial of service.
The vulnerability exists due to improper input validation in the ims-pcu driver control endpoint handling when parsing a malicious USB device interface. An attacker with physical access can provide a crafted device with a non-interrupt IN control endpoint to cause a denial of service.
The issue may lead to kernel warnings or undefined behavior.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/5b96b4da96313dd799a3a40dcfd598d2e2c19217
- https://git.kernel.org/stable/c/5de5075a1f26166f172b6687cb66810a9b61e3eb
- https://git.kernel.org/stable/c/7960d99332e03705ec622d92f31e0c77de8baac6
- https://git.kernel.org/stable/c/a630508a09b0c05f14bc0843ed409221a93751aa
- https://git.kernel.org/stable/c/aa1885f87e60c80e59e50ffd5fb096bf02c83e05
- https://git.kernel.org/stable/c/baf56975806534268e24acf9a8abb1c447ce11e9
- https://git.kernel.org/stable/c/c8d3d83f2eaaf7659de76e8d44e8fc88ee346042
- https://git.kernel.org/stable/c/cbfa059dfb48b9aa322e34fd44a093d9ca29ad7e