CVE-2026-72075 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
Input: ims-pcu - fix race condition in reset_device sysfs callback
The ims_pcu_reset_device() sysfs callback calls ims_pcu_execute_command() without acquiring pcu->cmd_mutex. This can lead to data races and corruption of the shared command buffer if triggered concurrently with other commands.
Acquire pcu->cmd_mutex before calling ims_pcu_execute_command().
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability under consideration involves a race condition within the Linux kernel's input subsystem, specifically affecting the ims-pcu driver component. This issue manifests in the reset_device sysfs callback function where improper synchronization mechanisms are employed during command execution. The ims_pcu_reset_device() function directly invokes ims_pcu_execute_command() without obtaining the necessary mutual exclusion lock, creating a scenario where concurrent access to shared resources can occur. Such race conditions represent a fundamental flaw in concurrent programming practices and are classified under CWE-362, which addresses concurrent execution using improper synchronization mechanisms.
The technical flaw stems from the absence of proper locking protocol when executing commands through the sysfs interface. The pcu->cmd_mutex serves as the primary synchronization primitive designed to protect access to the shared command buffer and related data structures. When reset_device is invoked concurrently with other command processing operations, multiple threads or processes can simultaneously attempt to write to or read from the same memory locations without proper coordination. This leads to potential data corruption where command buffers become inconsistent or overwritten, resulting in unpredictable behavior of the input device management system. The vulnerability directly impacts the integrity and reliability of device communication protocols within the kernel's input handling framework.
The operational impact of this race condition extends beyond simple data corruption to potentially compromise system stability and security. When multiple concurrent operations occur during device reset procedures, the command buffer may contain malformed or partially written commands that could cause downstream processing failures. This scenario creates opportunities for denial-of-service conditions where input devices become unresponsive or behave erratically, affecting user experience and system functionality. Additionally, such race conditions can provide potential attack vectors where malicious actors might exploit timing variations to inject malicious commands or manipulate device states, representing a security concern within the kernel's privilege escalation pathways.
Mitigation of this vulnerability requires implementing proper synchronization mechanisms by acquiring the pcu->cmd_mutex lock before invoking ims_pcu_execute_command() within the reset_device callback function. This approach aligns with established best practices for concurrent programming and follows the principle of least privilege in kernel space operations. The fix ensures that all command execution operations maintain exclusive access to shared resources, preventing race conditions while preserving system functionality. Security practitioners should consider this vulnerability in relation to ATT&CK technique T1068 which involves exploiting local privilege escalation opportunities through kernel-level race conditions, and T1499 which covers network denial of service attacks that may leverage such concurrency flaws. The patch demonstrates proper adherence to kernel development standards and emphasizes the critical importance of mutex acquisition in multi-threaded kernel subsystems where shared data structures are accessed concurrently.