Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-15T00:00:00 kernel: Input: ims-pcu - fix type confusion in CDC union descriptor parsing 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-843

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix type confusion in CDC union descriptor parsing The driver currently trusts the bMasterInterface0 from the CDC union descriptor without verifying that it matches the interface being probed. This could lead to the driver overwriting the private data of another interface. Validate that the control interface found in the descriptor is indeed the one we are probing.

A flaw was found in the Linux kernel's `ims-pcu` driver. A type confusion vulnerability exists in the CDC union descriptor parsing, where the driver trusts the `bMasterInterface0` value without proper verification. This could allow a local attacker, or a malicious USB device, to overwrite the private data of another interface, potentially leading to a denial of service.

Red Hat Enterprise Linux 10 Not affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-72074 https://nvd.nist.gov/vuln/detail/CVE-2026-72074 https://lore.kernel.org/linux-cve-announce/2026081519-CVE-2026-72074-2923@gregkh/T