Linux Kernel CVE-2026-80596

Three simultaneous conditions are required: (1) the system runs a Linux kernel version that includes commit 204d18a7a0c67352857dee1bbac517ed63f01d8e but not the respective fix commit for its stable branch; (2) an IMS Passenger Control Unit USB device is physically connected to the system and the ims-pcu module is loaded and bound to the device; and (3) the attacker has local access to the system and can access the sysfs path of the secondary data interface. The CVSS PR:N assignment suggests unprivileged local access may be sufficient depending on runtime sysfs node permissions, though this is not explicitly confirmed in the description. Systems without ims-pcu hardware attached are not exploitable under any circumstances. Distribution-enforced sysfs access restrictions (e.g., systemd-udevd permission overrides) may further limit who can reach the affected paths.

The NVD-assigned CVSS 3.1 score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) likely overstates the real-world impact: the description describes only 'unexpected behavior or crashes,' which maps cleanly to A:H, while C:H and I:H are not independently supported by any statement in the description or references. The PR:N component is plausible if the relevant sysfs nodes are world-accessible, but this depends on runtime permissions that vary by distribution. The EPSS score of 0.17% at the 6th percentile is consistent with the extreme scarcity of IMS Passenger Control Unit hardware in production environments - the attack surface is effectively zero on systems where the device is absent. The vulnerability is not listed in CISA KEV, no public exploit code has been identified, and the SSVC exploitation status is 'none.' The Tags field (Denial of Service, Linux) further supports that the primary realistic impact is a kernel panic rather than full confidentiality and integrity compromise. Overall, this should be addressed through normal kernel patching cycles rather than emergency response.

A local user on a Linux system where an IMS Passenger Control Unit USB device is connected navigates to the sysfs path for the device's secondary data interface (e.g., /sys/bus/usb/devices/X-Y.Z:A.B/) and reads or writes an attribute such as a firmware version or OFN attribute. The ims-pcu driver's handler executes against the data interface, which has no valid internal state for that operation, causing a NULL pointer dereference or invalid memory access in kernel context and crashing the system. No public proof-of-concept exploit has been identified at the time of this analysis.