CVE-2026-72076 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging
The debug logging in ims_pcu_irq() unconditionally prints data from pcu->urb_in_buf. However, if the interrupt fired for pcu->urb_ctrl, the actual data resides in pcu->urb_ctrl_buf. If urb->actual_length for the control URB exceeds pcu->max_in_size, this leads to an out-of-bounds read.
Fix this by printing from the correct buffer associated with the URB.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability exists within the Linux kernel's ims-pcu driver component where improper handling of debug logging operations creates a potential out-of-bounds memory access condition. This issue specifically manifests in the ims_pcu_irq() function which contains debug logging code that unconditionally references pcu->urb_in_buf without proper validation of which URB structure actually contains the relevant data. The root cause stems from the driver's failure to distinguish between different types of USB requests and their associated buffer allocations, creating a scenario where debug output attempts to access memory outside the bounds of the intended buffer.
The technical flaw represents a classic buffer overflow vulnerability that can be classified under CWE-129 as an insufficient bound checking in the context of memory access operations. When an interrupt occurs for the control URB rather than the input URB, the system incorrectly attempts to read from pcu->urb_in_buf while the actual data resides in pcu->urb_ctrl_buf instead. This misalignment becomes particularly dangerous when the control URB's actual_length exceeds the maximum input size threshold defined by pcu->max_in_size, causing memory access violations that can potentially expose sensitive kernel memory contents or trigger system instability.
The operational impact of this vulnerability extends beyond simple memory corruption to encompass potential security implications within kernel space operations. Attackers could theoretically exploit this condition to gain unauthorized access to kernel memory regions or potentially escalate privileges through controlled manipulation of USB interrupt handling sequences. The vulnerability affects systems utilizing the ims-pcu driver for USB communication, particularly those involving wireless networking equipment that rely on this specific kernel module for device control and data transfer operations.
Mitigation strategies should focus on implementing proper buffer validation within the debug logging subsystem to ensure that memory access operations only reference appropriate buffer locations based on the actual URB type being processed. The fix requires modifying the ims_pcu_irq() function to conditionally select the correct buffer based on which URB triggered the interrupt, thereby preventing out-of-bounds memory reads. This approach aligns with ATT&CK technique T1068 by addressing kernel-level privilege escalation vectors and follows secure coding practices that prevent unauthorized memory access patterns. Additionally, comprehensive testing should validate all interrupt handling paths to ensure proper buffer management across different USB communication scenarios and device states.