Heap-based buffer overflow in Linux kernel - CVE-2026-64565

Vulnerability details

The vulnerability allows an attacker with physical access to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in ims_pcu_handle_response() when processing oversized packets from a malicious USB device. An attacker with physical access can send a specially crafted oversized USB packet to execute arbitrary code.

The issue arises because ims_pcu_process_data() does not properly bound-check read_pos, allowing it to be overwritten and later used as a controlled index during response handling.

Affected software

How to mitigate CVE-2026-64565

External References

• https://git.kernel.org/stable/c/40bbbf2e91fd60715525bf0405c67876af817edf
• https://git.kernel.org/stable/c/875115b82c295277b81b6dfee7debc725f44e854
• https://git.kernel.org/stable/c/ca9f8c09845fb8c51b6d447f6428eecd1b8b0a49
• https://git.kernel.org/stable/c/d03a740e087de7dcb2a26dc1123377bd3d1d84ca

Related Security Bulletins

• Heap-based buffer overflow in Linux kernel input misc driver