Look up another CVE · open CVE-2026-80596 in the interactive tracker
CVE-2026-80596
Input: ims-pcu - only expose sysfs attributes on control interface
Published 2026-08-28 (2 months ago) by the Linux kernel CNA. Subsystem drivers/input. Debian urgency: unimportant.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2026-80596 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
When the driver was converted to use the driver core to instantiate device attributes (via .dev_groups in the usb_driver structure), the attributes started appearing on all interfaces bound to the driver. Since the ims-pcu driver manually claims the secondary data interface during probe, the driver core automatically creates the sysfs attributes for that interface as well. However, the driver only supports these attributes on the primary control interface. Data interfaces lack the necessary descriptors and internal state to handle these requests, and accessing them can lead to unexpected behavior or crashes. Fix this by updating the is_visible() callbacks for both the main and OFN attribute groups to verify that the interface being accessed is indeed the control interface.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/input/misc/ims-pcu.c
- What this is
- INPUT (KEYBOARD, MOUSE, JOYSTICK, TOUCHSCREEN) DRIVERSMAINTAINERS section matched on drivers/input/ · linux-input@vger.kernel.org · Maintained
- Kernel module
- none to look for. The file would have gone into ims_pcu, and Debian does not compile it into that module, so finding ims_pcu in lsmod would say nothing about this CVE.
Check it on the machine
grep -wE 'CONFIG_INPUT|CONFIG_INPUT_IMS_PCU|CONFIG_INPUT_MISC' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 4 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sidn
- n
- not enabled on any flavour - this release does not build the code
- Build switches
- CONFIG_INPUT, CONFIG_INPUT_IMS_PCU, CONFIG_INPUT_MISC
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-28 (2 months ago)source
- CVSS
- 8.4 high
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.20%, higher than 8.6% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/input
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.11 | 6.12.97 | 7d5e7c8d48f0 |
| 6.11 | 6.18.40 | 87e2f89dea07 |
| 6.11 | 7.1.5 | 73e6687be0c1 |
| 6.11 | 7.2 | 001428ea4d2c |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is reached by local sysfs read(2)/write(2) on ims-pcu driver attributes under /sys/bus/usb/devices/*, flowing through kernfs into ims_pcu_is_attr_visible() and the attribute show/store handlers; exploitation does not require remote network traffic or only plugging a USB cable without OS-level sysfs access.
- AC:LAttack complexity, low
- Once an IMS PCU (or compatible malicious USB gadget) is bound and the data interface exposes the duplicated dev_groups attributes, an attacker can deterministically trigger the fault by reading or writing those sysfs files on the data-interface kobject without races or uncontrollable victim state.
- PR:NPrivileges required, none
- Several exposed attributes are S_IRUGO (world-readable), and sysfs directory listing invokes is_visible() without write privileges; any local user who can read /sys can reach the vulnerable callbacks on the data interface without CAP_SYS_ADMIN or init-namespace root.
- UI:NUser interaction, none
- No cooperative victim action beyond the attacker performing the sysfs access themselves is required; the attacker does not need another user to mount filesystems, open applications, or perform GUI operations at exploit time.
- S:UScope, unchanged
- Impact is kernel memory corruption, device reset, or firmware-update misuse within the host OS boundary on systems carrying IMS Passenger Control Units (aircraft seats, kiosks); it enables local privilege escalation but does not cross VM, IOMMU, or hypervisor isolation.
- C:HConfidentiality impact, high
- Invoking control-only sysfs handlers from the data interface can corrupt shared ims_pcu command/URB state or dereference invalid interface data during is_visible/show paths, giving out-of-bounds reads or kernel pointer exposure beyond a pure NULL crash.
- I:HIntegrity impact, high
- Writable sysfs stores (reset_device, update_firmware, OFN register writes) on the wrong interface drive ims_pcu_execute_command() against incompletely initialized USB state, enabling arbitrary device reprogramming and heap corruption primitives exploitable for kernel control-flow hijack.
- A:HAvailability impact, high
- The fix description explicitly cites crashes from accessing data-interface sysfs attributes; malformed command/URB handling and NULL or inconsistent pcu state during teardown can trigger kernel oops, panic, or hung USB I/O on in-service passenger-control and kiosk systems.