CVE-2026-72078 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
Input: ims-pcu - validate control endpoint type
The driver currently assumes that the first endpoint of the control interface is an interrupt IN endpoint without verifying it. A malicious device could provide a different endpoint type, which would then be passed to usb_fill_int_urb(), potentially leading to kernel warnings or undefined behavior.
Verify that the control endpoint is an interrupt IN endpoint.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the ims-pcu driver within the Linux kernel ecosystem, specifically targeting how the driver handles USB control endpoint validation during device initialization. This issue stems from a fundamental lack of input validation that creates potential security risks and system instability. The driver's current implementation makes an unsafe assumption that the first endpoint of the control interface will always be an interrupt IN endpoint, without performing proper type verification before proceeding with kernel operations.
The technical flaw manifests when a malicious USB device presents endpoint descriptors that do not conform to expected specifications. When the ims-pcu driver encounters such non-compliant devices, it fails to validate the endpoint type before passing the descriptor information to the usb_fill_int_urb() function. This function expects specific endpoint characteristics that align with interrupt IN endpoint types, but receives data from potentially incorrect endpoint descriptors. The vulnerability creates a path for undefined behavior where kernel memory operations may become corrupted or system warnings may be generated, potentially leading to denial of service conditions.
This vulnerability directly relates to CWE-129 Input Validation and CWE-754 Improper Check for Unusual or Exceptional Conditions, as the driver fails to properly validate endpoint types before processing them. The operational impact extends beyond simple system warnings to potentially compromise kernel stability and security. Attackers could exploit this weakness by crafting malicious USB devices that present incorrect endpoint descriptors, causing the kernel to execute unintended code paths or corrupt kernel data structures. Such exploitation could lead to privilege escalation opportunities or system crashes that affect the overall reliability of USB device management within the Linux kernel.
The attack surface for this vulnerability aligns with ATT&CK technique T1059 Command and Scripting Interpreter where malicious USB devices could be used as attack vectors to compromise system integrity. The fix requires implementing proper endpoint type validation before any endpoint-specific operations are performed, ensuring that only interrupt IN endpoints are processed by usb_fill_int_urb(). This validation should occur during device enumeration and interface binding phases, verifying that the endpoint descriptor matches expected interrupt IN characteristics including proper endpoint attributes and direction flags.
Mitigation strategies include implementing comprehensive input validation routines that check endpoint descriptor types against expected values before any kernel operations are performed. The driver should verify that endpoint type bits match the required interrupt IN specification and that the endpoint direction aligns with expected input characteristics. Additionally, proper error handling should be implemented to gracefully reject non-compliant devices rather than attempting to process them through kernel functions that expect specific endpoint configurations. System administrators should ensure kernel updates are applied promptly to address this vulnerability, as it represents a fundamental security flaw in USB device handling mechanisms that could be exploited by attackers with physical access to target systems.
This vulnerability demonstrates the critical importance of proper input validation in kernel space drivers, where insufficient validation can lead to serious security implications. The fix represents a standard defensive programming approach that aligns with secure coding practices recommended for kernel development and USB driver implementation within the Linux ecosystem.