EUVD-2026-67472
GHSA-9f8c-25qh-cpfj
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Crash triggered via local sysfs access on a specific USB data interface; only availability impact described; PR:L reflects typical sysfs access requiring at least user-level local session.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
Input: ims-pcu - only expose sysfs attributes on control interface
When the driver was converted to use the driver core to instantiate device attributes (via .dev_groups in the usb_driver structure), the attributes started appearing on all interfaces bound to the driver. Since the ims-pcu driver manually claims the secondary data interface during probe, the driver core automatically creates the sysfs attributes for that interface as well.
However, the driver only supports these attributes on the primary control interface. Data interfaces lack the necessary descriptors and internal state to handle these requests, and accessing them can lead to unexpected behavior or crashes.
Fix this by updating the is_visible() callbacks for both the main and OFN attribute groups to verify that the interface being accessed is indeed the control interface.
AnalysisAI
The Linux kernel ims-pcu USB driver exposes sysfs device attributes on the secondary data interface in addition to the intended primary control interface, allowing local users to trigger kernel crashes or undefined behavior by accessing those attributes on the data interface, which lacks the descriptors and internal state the driver requires. Affected systems must have an IMS Passenger Control Unit USB device physically connected and run a kernel version between commit 204d18a7a0c67352857dee1bbac517ed63f01d8e and the respective fix commits. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three simultaneous conditions are required: (1) the system runs a Linux kernel version that includes commit 204d18a7a0c67352857dee1bbac517ed63f01d8e but not the respective fix commit for its stable branch; (2) an IMS Passenger Control Unit USB device is physically connected to the system and the ims-pcu module is loaded and bound to the device; and (3) the attacker has local access to the system and can access the sysfs path of the secondary data interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) likely overstates the real-world impact: the description describes only 'unexpected behavior or crashes,' which maps cleanly to A:H, while C:H and I:H are not independently supported by any statement in the description or references. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available (multiple stable commits); released patched versions per EUVD are Linux 6.12.97, 6.18.40, 7.1.5, and 7.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory systems containing IMS Passenger Control Unit USB devices to determine potential exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today