Improper access control in Linux kernel - CVE-2026-80596

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in the ims-pcu sysfs attribute handlers when accessing sysfs attributes through a non-control interface. A local user can access exposed sysfs attributes on a secondary data interface to cause a denial of service.

The issue occurs because the driver exposes device attributes on all interfaces bound to the driver, even though only the primary control interface has the required descriptors and internal state.

Affected software

How to mitigate CVE-2026-80596

External References

• https://git.kernel.org/stable/c/001428ea4d2c371107cb984108e266adf99f1f1e
• https://git.kernel.org/stable/c/73e6687be0c1c323a8ec5b733f29440a93e08ff2
• https://git.kernel.org/stable/c/7d5e7c8d48f0aaeb9ec90a9a4f450f3c5e422431
• https://git.kernel.org/stable/c/87e2f89dea078572fb9e13864cec2b1bd8e89b71

Related Security Bulletins

• Improper access control in Linux kernel input misc driver