CVE-2026-80596

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80596", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.770Z", "datePublished": "2026-08-28T06:48:22.892Z", "dateUpdated": "2026-08-29T06:21:08.760Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-29T06:21:08.760Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: ims-pcu - only expose sysfs attributes on control interface\n\nWhen the driver was converted to use the driver core to instantiate device\nattributes (via .dev_groups in the usb_driver structure), the attributes\nstarted appearing on all interfaces bound to the driver. Since the ims-pcu\ndriver manually claims the secondary data interface during probe, the\ndriver core automatically creates the sysfs attributes for that interface\nas well.\n\nHowever, the driver only supports these attributes on the primary control\ninterface. Data interfaces lack the necessary descriptors and internal\nstate to handle these requests, and accessing them can lead to unexpected\nbehavior or crashes.\n\nFix this by updating the is_visible() callbacks for both the main and OFN\nattribute groups to verify that the interface being accessed is indeed the\ncontrol interface."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached by local sysfs read(2)/write(2) on ims-pcu driver attributes under /sys/bus/usb/devices/*, flowing through kernfs into ims_pcu_is_attr_visible() and the attribute show/store handlers; exploitation does not require remote network traffic or only plugging a USB cable without OS-level sysfs access.\nAC:L - Once an IMS PCU (or compatible malicious USB gadget) is bound and the data interface exposes the duplicated dev_groups attributes, an attacker can deterministically trigger the fault by reading or writing those sysfs files on the data-interface kobject without races or uncontrollable victim state.\nPR:N - Several exposed attributes are S_IRUGO (world-readable), and sysfs directory listing invokes is_visible() without write privileges; any local user who can read /sys can reach the vulnerable callbacks on the data interface without CAP_SYS_ADMIN or init-namespace root.\nUI:N - No cooperative victim action beyond the attacker performing the sysfs access themselves is required; the attacker does not need another user to mount filesystems, open applications, or perform GUI operations at exploit time.\nS:U - Impact is kernel memory corruption, device reset, or firmware-update misuse within the host OS boundary on systems carrying IMS Passenger Control Units (aircraft seats, kiosks); it enables local privilege escalation but does not cross VM, IOMMU, or hypervisor isolation.\nC:H - Invoking control-only sysfs handlers from the data interface can corrupt shared ims_pcu command/URB state or dereference invalid interface data during is_visible/show paths, giving out-of-bounds reads or kernel pointer exposure beyond a pure NULL crash.\nI:H - Writable sysfs stores (reset_device, update_firmware, OFN register writes) on the wrong interface drive ims_pcu_execute_command() against incompletely initialized USB state, enabling arbitrary device reprogramming and heap corruption primitives exploitable for kernel control-flow hijack.\nA:H - The fix description explicitly cites crashes from accessing data-interface sysfs attributes; malformed command/URB handling and NULL or inconsistent pcu state during teardown can trigger kernel oops, panic, or hung USB I/O on in-service passenger-control and kiosk systems."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/input/misc/ims-pcu.c"], "versions": [{"version": "204d18a7a0c67352857dee1bbac517ed63f01d8e", "lessThan": "7d5e7c8d48f0aaeb9ec90a9a4f450f3c5e422431", "status": "affected", "versionType": "git"}, {"version": "204d18a7a0c67352857dee1bbac517ed63f01d8e", "lessThan": "87e2f89dea078572fb9e13864cec2b1bd8e89b71", "status": "affected", "versionType": "git"}, {"version": "204d18a7a0c67352857dee1bbac517ed63f01d8e", "lessThan": "73e6687be0c1c323a8ec5b733f29440a93e08ff2", "status": "affected", "versionType": "git"}, {"version": "204d18a7a0c67352857dee1bbac517ed63f01d8e", "lessThan": "001428ea4d2c371107cb984108e266adf99f1f1e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/input/misc/ims-pcu.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7d5e7c8d48f0aaeb9ec90a9a4f450f3c5e422431"}, {"url": "https://git.kernel.org/stable/c/87e2f89dea078572fb9e13864cec2b1bd8e89b71"}, {"url": "https://git.kernel.org/stable/c/73e6687be0c1c323a8ec5b733f29440a93e08ff2"}, {"url": "https://git.kernel.org/stable/c/001428ea4d2c371107cb984108e266adf99f1f1e"}], "title": "Input: ims-pcu - only expose sysfs attributes on control interface", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/input/misc/ims-pcu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7d5e7c8d48f0aaeb9ec90a9a4f450f3c5e422431", "status": "affected", "version": "204d18a7a0c67352857dee1bbac517ed63f01d8e", "versionType": "git"}, {"lessThan": "87e2f89dea078572fb9e13864cec2b1bd8e89b71", "status": "affected", "version": "204d18a7a0c67352857dee1bbac517ed63f01d8e", "versionType": "git"}, {"lessThan": "73e6687be0c1c323a8ec5b733f29440a93e08ff2", "status": "affected", "version": "204d18a7a0c67352857dee1bbac517ed63f01d8e", "versionType": "git"}, {"lessThan": "001428ea4d2c371107cb984108e266adf99f1f1e", "status": "affected", "version": "204d18a7a0c67352857dee1bbac517ed63f01d8e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/input/misc/ims-pcu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: ims-pcu - only expose sysfs attributes on control interface\n\nWhen the driver was converted to use the driver core to instantiate device\nattributes (via .dev_groups in the usb_driver structure), the attributes\nstarted appearing on all interfaces bound to the driver. Since the ims-pcu\ndriver manually claims the secondary data interface during probe, the\ndriver core automatically creates the sysfs attributes for that interface\nas well.\n\nHowever, the driver only supports these attributes on the primary control\ninterface. Data interfaces lack the necessary descriptors and internal\nstate to handle these requests, and accessing them can lead to unexpected\nbehavior or crashes.\n\nFix this by updating the is_visible() callbacks for both the main and OFN\nattribute groups to verify that the interface being accessed is indeed the\ncontrol interface."}], "id": "CVE-2026-80596", "lastModified": "2026-08-29T07:16:44.620", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-28T08:16:43.320", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/001428ea4d2c371107cb984108e266adf99f1f1e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/73e6687be0c1c323a8ec5b733f29440a93e08ff2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7d5e7c8d48f0aaeb9ec90a9a4f450f3c5e422431"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/87e2f89dea078572fb9e13864cec2b1bd8e89b71"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Input: ims-pcu - only expose sysfs attributes on control interface", "id": "2525487", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525487"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-908", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nInput: ims-pcu - only expose sysfs attributes on control interface\nWhen the driver was converted to use the driver core to instantiate device\nattributes (via .dev_groups in the usb_driver structure), the attributes\nstarted appearing on all interfaces bound to the driver. Since the ims-pcu\ndriver manually claims the secondary data interface during probe, the\ndriver core automatically creates the sysfs attributes for that interface\nas well.\nHowever, the driver only supports these attributes on the primary control\ninterface. Data interfaces lack the necessary descriptors and internal\nstate to handle these requests, and accessing them can lead to unexpected\nbehavior or crashes.\nFix this by updating the is_visible() callbacks for both the main and OFN\nattribute groups to verify that the interface being accessed is indeed the\ncontrol interface.", "A flaw was found in the Linux kernel's ims-pcu driver. This vulnerability occurs because sysfs attributes, intended only for the control interface, are improperly exposed on all interfaces. A local user could exploit this by accessing these attributes on data interfaces, leading to unexpected system behavior or crashes."], "name": "CVE-2026-80596", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80596\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80596\nhttps://lore.kernel.org/linux-cve-announce/2026082830-CVE-2026-80596-a0f9@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[204d18a7a0c67352857dee1bbac517ed63f01d8e,7d5e7c8d48f0aaeb9ec90a9a4f450f3c5e422431)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[204d18a7a0c67352857dee1bbac517ed63f01d8e,87e2f89dea078572fb9e13864cec2b1bd8e89b71)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[204d18a7a0c67352857dee1bbac517ed63f01d8e,73e6687be0c1c323a8ec5b733f29440a93e08ff2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[204d18a7a0c67352857dee1bbac517ed63f01d8e,001428ea4d2c371107cb984108e266adf99f1f1e)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-28T09:30:17.970971+00:00", "updated": "2026-09-02T06:45:05.270819+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}