CVE-2026-80594: Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing
In the Linux kernel, the following vulnerability has been resolved:
Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing
The driver parses CDC union descriptors in imspcugetcdcuniondesc() by iterating through the extra descriptor data. However, it does not verify that the bLength of each descriptor is at least 2. A malicious device could provide a descriptor with bLength = 0, leading to an infinite loop in the driver.
Add a check to ensure bLength is at least 2 before proceeding with parsing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In ims_pcu_get_cdc_union_desc(), add a check to ensure the bLength of each descriptor is at least 2 before proceeding with CDC union descriptor parsing, to prevent an infinite loop when a device provides bLength = 0.
Linux kernel (ims-pcu driver) bLength validation in ims_pcu_get_cdc_union_desc() = Reject/stop parsing when a CDC union descriptor bLength is less than 2
Event History
Frequently Asked Questions
What must an attacker control to trigger this issue?
An attacker must provide a malicious device whose CDC union descriptor has a bLength value of 0. This causes the ims-pcu driver's descriptor-parsing loop not to advance.
What is the practical impact of successful exploitation?
The affected driver can enter an infinite loop while parsing the malicious descriptor, potentially causing the kernel to hang in that parsing path.
How can I tell whether a device is attempting to trigger this vulnerability?
Inspect CDC union descriptors presented by devices used with the ims-pcu driver. A descriptor with bLength set to 0 is the malformed condition described for this issue.