CVE-2026-80596 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
Input: ims-pcu - only expose sysfs attributes on control interface
When the driver was converted to use the driver core to instantiate device attributes (via .dev_groups in the usb_driver structure), the attributes started appearing on all interfaces bound to the driver. Since the ims-pcu driver manually claims the secondary data interface during probe, the driver core automatically creates the sysfs attributes for that interface as well.
However, the driver only supports these attributes on the primary control interface. Data interfaces lack the necessary descriptors and internal state to handle these requests, and accessing them can lead to unexpected behavior or crashes.
Fix this by updating the is_visible() callbacks for both the main and OFN attribute groups to verify that the interface being accessed is indeed the control interface.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in the Linux kernel's ims-pcu driver stems from an incorrect implementation of sysfs attribute visibility following a refactoring effort aimed at aligning with modern driver core practices. The ims-pcu driver manages USB devices that typically present multiple interfaces, including a primary control interface and one or more secondary data interfaces. During a transition to utilize the driver core's mechanism for instantiating device attributes via the .dev_groups field in the usb_driver structure, the visibility logic was not adequately restricted. This architectural shift caused sysfs attributes associated with power management and other operational controls to be exposed on all USB interfaces bound to the driver, rather than being confined strictly to the primary control interface where they are functionally valid.
The technical flaw lies in the absence of conditional checks within the is_visible callbacks for both the main and OFN attribute groups. These callbacks determine whether specific sysfs entries should be visible to user space based on the current context. Because the driver manually claims the secondary data interfaces during its probe routine, the kernel's device model automatically generates sysfs nodes for these additional interfaces as well. However, the internal state of the ims-pcu driver and the USB descriptors associated with data interfaces do not support the operations required by these attributes. The control interface contains the necessary logic to handle requests related to power states and operational flags, whereas the data interfaces are designed solely for packet transmission and lack the requisite context to process such administrative commands safely.
The operational impact of this vulnerability is significant, as it allows unprivileged or malicious user space processes to interact with sysfs attributes on interfaces that cannot properly service them. Accessing these misaligned endpoints can lead to undefined behavior within the kernel, including potential null pointer dereferences, memory corruption, or complete system crashes due to invalid state transitions. This represents a denial of service vector and potentially an avenue for privilege escalation if the resulting instability allows for exploitation of other kernel mechanisms. The issue highlights the risks associated with bulk attribute exposure without rigorous interface-specific validation, particularly in drivers that manage multi-interface USB devices where functional boundaries between control and data paths are strict.
To mitigate this vulnerability, the fix involves updating the is_visible callbacks to explicitly verify that the interface being accessed corresponds to the primary control interface before exposing any attributes. This ensures that sysfs entries remain invisible on secondary data interfaces, thereby preventing user space from issuing commands that the driver cannot safely execute. From a standards perspective, this issue aligns with CWE-20 Improper Input Validation, as the system failed to validate that the input context matched the expected operational scope of the resource. Furthermore, it relates to ATT&CK technique T1548 Abuse Elevation Control Mechanism, where an attacker might exploit improperly configured access controls or exposed interfaces to perform actions outside their intended permissions. Administrators should ensure that systems running affected kernel versions are updated with patches that enforce strict interface-specific visibility checks for the ims-pcu driver attributes.