CVE-2026-72079: Input: ims-pcu - fix use-after-free and double-free in disconnect
In the Linux kernel, the following vulnerability has been resolved:
Input: ims-pcu - fix use-after-free and double-free in disconnect
imspcudisconnect() only intended to perform cleanup when the primary (control) interface is unbound. However, it currently relies on the interface class to distinguish between control and data interfaces. A malicious device could present a data interface with the same class as the control interface, leading to premature cleanup and potential use-after-free or double-free.
Switch to verifying that the interface being disconnected is indeed the control interface.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72079?
CVE-2026-72079 has a risk rating of 43.
What types of vulnerabilities are involved in CVE-2026-72079?
CVE-2026-72079 involves use-after-free and double-free vulnerabilities in the Linux kernel.
How do I fix CVE-2026-72079?
To fix CVE-2026-72079, ensure you update to the patched version of the Linux kernel that addresses the ims-pcu disconnect issue.
What systems are affected by CVE-2026-72079?
CVE-2026-72079 affects systems running vulnerable versions of the Linux kernel that use the ims-pcu component.
When was CVE-2026-72079 published?
CVE-2026-72079 was published on August 15, 2026.