Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-15T00:00:00 kernel: Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-125

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging The debug logging in ims_pcu_irq() unconditionally prints data from pcu->urb_in_buf. However, if the interrupt fired for pcu->urb_ctrl, the actual data resides in pcu->urb_ctrl_buf. If urb->actual_length for the control URB exceeds pcu->max_in_size, this leads to an out-of-bounds read. Fix this by printing from the correct buffer associated with the URB.

A flaw was found in the Linux kernel's `ims-pcu` driver. The debug logging in the `ims_pcu_irq()` function can attempt to read data beyond the allocated buffer when processing certain Universal Serial Bus (USB) control requests. This out-of-bounds read occurs if the length of the control request exceeds the expected maximum input size. A local attacker could potentially use this flaw to cause a denial of service or disclose sensitive information from kernel memory.

Red Hat Enterprise Linux 10 Not affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-72076 https://nvd.nist.gov/vuln/detail/CVE-2026-72076 https://lore.kernel.org/linux-cve-announce/2026081520-CVE-2026-72076-92c7@gregkh/T