CVE-2026-80596

A flaw was found in the Linux kernel's ims-pcu driver. This vulnerability occurs because sysfs attributes, intended only for the control interface, are improperly exposed on all interfaces. A local user could exploit this by accessing these attributes on data interfaces, leading to unexpected system behavior or crashes.

A flaw of MODERATE impact was found in the Linux kernel ims-pcu USB input driver. When the driver was converted to instantiate its device attributes through the driver core (.dev_groups in the usb_driver structure), its sysfs attributes started appearing on all USB interfaces bound to the driver, including the secondary data interface that the driver manually claims during probe. Those attributes are only supported on the primary control interface: data interfaces lack the necessary descriptors and internal state to handle such requests, so a local user who accesses the attributes on a data interface could cause unexpected behavior or a system crash, resulting in denial of service. Red Hat rated this flaw MODERATE (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access with user privileges and the impact is limited to availability. This differs from the upstream CVEORG score of 8.4 (IMPORTANT), which assumes no privileges are required and high confidentiality and integrity impacts that the technical evidence does not support. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt streams evaluated for this flaw are not affected because the vulnerable code is not present in the shipped kernel versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.