CVE-2026-64565: Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()

In the Linux kernel, the following vulnerability has been resolved:

Input: ims-pcu - fix heap-buffer-overflow in imspcuprocessdata()

The imspcuprocessdata() processes incoming URB data byte by byte. However, it fails to check if the readpos index exceeds IMSPCUBUFSIZE.

If a malicious USB device sends a packet larger than IMSPCUBUFSIZE, readpos will increment indefinitely. Moreover, since readpos is located immediately after readbuf, the attacker can overwrite readpos itself to arbitrarily control the index.

This manipulated readpos is subsequently used in imspcuhandleresponse() to copy data into cmdbuf, leading to a heap buffer overflow.

Specifically, an attacker can overwrite the cmddone.wait.head located at offset 136 relative to cmdbuf in the imspcuhandleresponse(). Consequently, when the driver calls complete(&pcu->cmddone), it triggers a control flow hijack by using the manipulated pointer.

Fix this by adding a bounds check for readpos before writing to readbuf. If the packet is too long, discard it, log a warning, and reset the parser state.

[dtor: factor out resetting packet state, reset checksum as well]