CVE-2026-72079 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
Input: ims-pcu - fix use-after-free and double-free in disconnect
ims_pcu_disconnect() only intended to perform cleanup when the primary (control) interface is unbound. However, it currently relies on the interface class to distinguish between control and data interfaces. A malicious device could present a data interface with the same class as the control interface, leading to premature cleanup and potential use-after-free or double-free.
Switch to verifying that the interface being disconnected is indeed the control interface.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the linux kernel's ims-pcu driver which handles communication with certain wireless devices through USB interfaces. This particular flaw stems from improper handling of interface disconnection logic within the ims_pcu_disconnect() function, creating a scenario where memory management errors can occur during device removal or unplugging operations. The issue specifically manifests when the kernel attempts to clean up resources associated with a USB device connection, particularly when dealing with multiple interfaces that serve different purposes within the same device configuration.
The technical root cause lies in the driver's reliance on interface class matching as the primary discriminator between control and data interfaces during disconnection events. When a malicious device presents a data interface that matches the class identifier of the control interface, the kernel incorrectly identifies the data interface as the primary control interface and proceeds with cleanup operations that should only occur on the actual control interface. This misidentification triggers improper resource management where the cleanup code executes against the wrong interface type, leading to memory allocation states that are no longer valid or have already been freed.
The operational impact of this vulnerability extends beyond simple memory corruption, as it creates conditions that could enable arbitrary code execution or system instability during normal device disconnection scenarios. The use-after-free condition occurs when the driver attempts to access memory that has already been deallocated due to premature cleanup operations, while the double-free scenario happens when the same memory region gets freed twice through different code paths. These memory management errors can be exploited by attackers who control a malicious USB device to cause system crashes or potentially escalate privileges within the kernel space.
The vulnerability demonstrates characteristics consistent with CWE-415 and CWE-416, representing improper handling of memory allocation states during interface cleanup operations. The fix implemented addresses this by changing the verification mechanism from class-based matching to explicit interface type checking that confirms the specific control interface is being disconnected before any cleanup occurs. This approach aligns with defense-in-depth principles advocated by security frameworks and reduces the attack surface by eliminating the reliance on potentially spoofable interface class identifiers.
Mitigation strategies should focus on ensuring that all kernel drivers properly validate interface types before executing cleanup operations, particularly in scenarios where multiple interfaces of different purposes exist within the same device configuration. System administrators should ensure kernel updates are applied promptly to address this vulnerability, while security researchers should monitor for similar patterns in other USB or network driver implementations that might rely on interface class matching for resource management decisions. The fix represents a fundamental improvement in driver robustness and helps prevent similar issues across other kernel subsystems where interface identification and cleanup operations are critical components of device management.