CVE-2026-72078

A flaw was found in the Linux kernel's ims-pcu driver. This driver incorrectly assumes that the first endpoint of the control interface is an interrupt IN endpoint without proper validation. A malicious Universal Serial Bus (USB) device could exploit this by providing a different endpoint type. This improper input is then passed to the usb_fill_int_urb() function, which could lead to kernel warnings or undefined behavior, potentially causing system instability or a denial of service.

This vulnerability is rated as Moderate impact because successful exploitation is confined to local denial-of-service conditions and requires either physical access to attach a malicious hardware device or control over emulated USB peripherals in a virtualized guest. Additionally, the affected IMS Passenger Control Unit driver is not enabled by default in standard Red Hat Enterprise Linux installations, minimizing exposure across enterprise environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.