Improper input validation in Linux kernel - CVE-2026-80594
Published: August 28, 2026
Vulnerability identifier: #VU146281
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80594
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker with physical access to cause a denial of service.
The vulnerability exists due to improper input validation in ims_pcu_get_cdc_union_desc() when parsing CDC union descriptors from a malicious USB device. An attacker with physical access can provide a crafted descriptor with bLength set to 0 to cause a denial of service.
Affected software
Linux kernel
How to mitigate CVE-2026-80594
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/383934c249a9817d242d02d30bfbc8defbf0d533
- https://git.kernel.org/stable/c/6314bd9e2a6b3362998dc85485dd4b0f133a3532
- https://git.kernel.org/stable/c/67a038c5a7c9bd8aabe6fba8ac9d2e31c0bd5a28
- https://git.kernel.org/stable/c/76eeeb3a8e3c13d5c0ef28666b57dcb5cc101a32
- https://git.kernel.org/stable/c/b847f2725ef47a26b3d01eca3d54fd811e5a544d
- https://git.kernel.org/stable/c/bbbe31486cf2d12177462e4a814244c2597c9849
- https://git.kernel.org/stable/c/d4579af29e67ca8722db0a1194227f8015c8981d
- https://git.kernel.org/stable/c/e3f93d63dcd48c1f0ba9041f2ffa8aea7170e295