CVE-2026-72074

A flaw was found in the Linux kernel's ims-pcu driver. A type confusion vulnerability exists in the CDC union descriptor parsing, where the driver trusts the bMasterInterface0 value without proper verification. This could allow a local attacker, or a malicious USB device, to overwrite the private data of another interface, potentially leading to a denial of service.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because successful exploitation requires physical access to insert a crafted USB peripheral or the capability to emulate USB devices within a virtual guest. Additionally, the affected driver is not enabled in default Red Hat Enterprise Linux kernel configurations, substantially limiting real-world exposure. In environments where the module is utilized, the flaw is confined to kernel memory corruption leading to a local denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.