CVE-2026-64565

A flaw was found in the Linux kernel's ims-pcu component. A malicious USB device can send an oversized data packet, which is not properly handled. This can lead to a heap buffer overflow, allowing an attacker to manipulate internal pointers. Successful exploitation could result in a control flow hijack, potentially enabling arbitrary code execution on the system.

This flaw is rated with an Important severity rather than Moderate because corrupted kernel memory can permit an unprivileged actor to gain full system control. Exploitation demands either local physical access to insert a malicious USB device or the capability to attach emulated hardware to a virtual machine guest. In default Red Hat Enterprise Linux installations, the affected IMS PCU driver is not enabled, leaving standard production deployments unexposed to this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.