CVE-2026-72078: Input: ims-pcu - validate control endpoint type
In the Linux kernel, the following vulnerability has been resolved:
Input: ims-pcu - validate control endpoint type
The driver currently assumes that the first endpoint of the control interface is an interrupt IN endpoint without verifying it. A malicious device could provide a different endpoint type, which would then be passed to usbfillinturb(), potentially leading to kernel warnings or undefined behavior.
Verify that the control endpoint is an interrupt IN endpoint.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72078?
The severity of CVE-2026-72078 is rated at 27.
How do I fix CVE-2026-72078?
To fix CVE-2026-72078, update your Linux kernel to the latest version where this vulnerability has been patched.
What is the impact of CVE-2026-72078?
CVE-2026-72078 allows a malicious device to exploit an improperly validated control endpoint type in the Linux kernel.
Which version of the Linux kernel is affected by CVE-2026-72078?
CVE-2026-72078 affects the specific versions of the Linux kernel prior to the patch release.
Is CVE-2026-72078 exploit-related?
Yes, CVE-2026-72078 is related to potential exploitation through an invalid control endpoint type provided by a malicious device.