CVE-2026-80595 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
Input: ims-pcu - add response length checks
The driver processes response data from device buffers without verifying that the device actually sent enough data. This can lead to out-of-bounds reads or processing stale data.
Add checks for the expected response length before accessing the buffers.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The Linux kernel driver for the IMS PCU, specifically within the input subsystem, contained a critical logic flaw related to buffer validation during device communication. The vulnerability stems from an insufficient verification of response lengths received from hardware devices. When the driver processes data returned by the connected peripheral, it fails to confirm that the actual amount of data present in the device buffers meets or exceeds the expected length required for safe processing. This oversight creates a scenario where the software proceeds with operations on incomplete or truncated datasets, fundamentally violating the principle of trusting only validated input from external sources.
From a technical perspective, this lack of bounds checking allows for out-of-bounds memory reads when the driver attempts to access buffer locations that were not populated by the device due to short responses. Furthermore, if the system does not properly clear or handle partial data, it may process stale information left in buffers from previous operations. This behavior aligns with CWE-125, which describes out-of-bounds read vulnerabilities, and CWE-367, which pertains to time-of-check-time-of-use (TOCTOU) race conditions if the state changes between verification and usage. The absence of strict length validation means that memory safety is compromised, potentially leading to kernel panics or information disclosure depending on how the malformed data interacts with subsequent system calls.
The operational impact of this vulnerability can vary significantly based on the specific hardware configuration and attack surface available to an adversary. In a local context, if an attacker has physical access to the device or control over the interface communicating with the IMS PCU, they could craft malicious responses that trigger these out-of-bounds reads. This could result in denial of service through kernel crashes, which disrupts system availability. More critically, depending on what memory regions are exposed by the invalid read, there is a potential for information leakage, allowing an attacker to窥探 sensitive kernel data structures or credentials stored adjacent to the affected buffer. While remote exploitation via network interfaces is less likely given the hardware-specific nature of this driver, local privilege escalation remains a risk if the leaked information aids in further exploits within the same execution context.
Mitigation strategies primarily involve applying the upstream Linux kernel patch that introduces explicit response length checks before any buffer access occurs. System administrators should ensure their systems are updated to include these fixes as part of standard security maintenance routines. For developers and maintainers, this incident reinforces the necessity of implementing rigorous input validation at all boundaries where external data enters the system. Adhering to secure coding practices that mandate checking array bounds and verifying payload sizes before processing is essential to prevent similar flaws. Additionally, integrating static analysis tools configured with rules for CWE-125 into the development pipeline can help detect such omissions early in the software lifecycle, reducing the risk of deploying vulnerable code into production environments.