CVE-2026-72075: Input: ims-pcu - fix race condition in reset_device sysfs callback
In the Linux kernel, the following vulnerability has been resolved:
Input: ims-pcu - fix race condition in resetdevice sysfs callback
The imspcuresetdevice() sysfs callback calls imspcuexecutecommand() without acquiring pcu->cmdmutex. This can lead to data races and corruption of the shared command buffer if triggered concurrently with other commands.
Acquire pcu->cmdmutex before calling imspcuexecutecommand().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the ims-pcu reset_device sysfs callback, acquire pcu->cmd_mutex before calling ims_pcu_execute_command() to prevent concurrent command execution from causing data races and corruption of the shared command buffer.
Linux kernel (ims-pcu) pcu->cmd_mutex acquisition in ims_pcu_reset_device() sysfs callback = acquire before calling ims_pcu_execute_command()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72075?
CVE-2026-72075 has a risk rating of 26, indicating a significant impact on system stability.
How do I fix CVE-2026-72075?
To fix CVE-2026-72075, ensure that you update to the latest version of the Linux kernel where the vulnerability has been patched.
What type of vulnerability is CVE-2026-72075?
CVE-2026-72075 is categorized as a race condition vulnerability in the Linux kernel.
What components are affected by CVE-2026-72075?
CVE-2026-72075 specifically affects the ims-pcu subsystem within the Linux kernel.
Can CVE-2026-72075 lead to system instability?
Yes, CVE-2026-72075 can lead to data races and potential corruption of shared data, causing system instability.