SB20260828198 - Improper access control in Linux kernel input misc driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper access control (CVE-ID: CVE-2026-80596)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in the ims-pcu sysfs attribute handlers when accessing sysfs attributes through a non-control interface. A local user can access exposed sysfs attributes on a secondary data interface to cause a denial of service.

The issue occurs because the driver exposes device attributes on all interfaces bound to the driver, even though only the primary control interface has the required descriptors and internal state.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/001428ea4d2c371107cb984108e266adf99f1f1e
• https://git.kernel.org/stable/c/73e6687be0c1c323a8ec5b733f29440a93e08ff2
• https://git.kernel.org/stable/c/7d5e7c8d48f0aaeb9ec90a9a4f450f3c5e422431
• https://git.kernel.org/stable/c/87e2f89dea078572fb9e13864cec2b1bd8e89b71