CVE-2026-72074
Input: ims-pcu - fix type confusion in CDC union descriptor parsing
Not available
At a glance
- Source
- NVD
- EPSS
- EPSS 0.22 % · percentile 12 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix type confusion in CDC union descriptor parsing The driver currently trusts the bMasterInterface0 from the CDC union descriptor without verifying that it matches the interface being probed. This could lead to the driver overwriting the private data of another interface. Validate that the control interface found in the descriptor is indeed the one we are probing.
References
- https://git.kernel.org/stable/c/ab87cd7789d00f441f60a016cbcff35abe76513c
- https://git.kernel.org/stable/c/b5518c5632f3485849421b9c33b4db5ae6a54ed7
- https://git.kernel.org/stable/c/163c3e7a1de6b3d5c85edb3bdf4cf087382103b0
- https://git.kernel.org/stable/c/08bf4b6ee28987570f4b3f1954427621fa291bf5
- https://git.kernel.org/stable/c/fa7f65c5315a25b310daae69ab527efd420e37fa
- https://git.kernel.org/stable/c/0e8115a7ed9a99ff9495615a575a6c0f43566d10
- https://git.kernel.org/stable/c/f4cf878dcc4f6f02e7a25294bfaed4361264995e
- https://git.kernel.org/stable/c/ca459e237bc49567649c56bc72e4c602fb92fd67
European references
- ENISA EUVD · EUVD-2026-59032
- GCVE · GCVE-0-2026-72074
CERT-FR advisories
- CERTFR-2026-AVI-1333 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1286 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 628329d52474323938a03826941e166bc7c8eff4 < ab87cd7789d00f441f60a016cbcff35abe76513c ; affected 628329d52474323938a03826941e166bc7c8eff4 < b5518c5632f3485849421b9c33b4db5ae6a54ed7 ; affected 628329d52474323938a03826941e166bc7c8eff4 < 163c3e7a1de6b3d5c85edb3bdf4cf087382103b0 ; affected 628329d52474323938a03826941e166bc7c8eff4 < 08bf4b6ee28987570f4b3f1954427621fa291bf5 ; affected 628329d52474323938a03826941e166bc7c8eff4 < fa7f65c5315a25b310daae69ab527efd420e37fa ; affected 628329d52474323938a03826941e166bc7c8eff4 < 0e8115a7ed9a99ff9495615a575a6c0f43566d10 |
| Linux · Linux | affected 3.10 ; unaffected 0 < 3.10 ; unaffected 5.10.261 ≤ 5.10.* ; unaffected 5.15.212 ≤ 5.15.* ; unaffected 6.1.178 ≤ 6.1.* ; unaffected 6.6.145 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |