CVE-2026-80595: Input: ims-pcu - add response length checks
In the Linux kernel, the following vulnerability has been resolved:
Input: ims-pcu - add response length checks
The driver processes response data from device buffers without verifying that the device actually sent enough data. This can lead to out-of-bounds reads or processing stale data.
Add checks for the expected response length before accessing the buffers.
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
The affected ims-pcu driver must process a device response that is shorter than the data it expects. The available information does not state whether a local attacker, physical device access, or a malformed device is required to produce such a response.
What is the impact of receiving a truncated response?
The driver can read beyond the received response buffer or process stale data because it accesses response fields without first confirming that enough data was received.
How can the issue be remediated?
Apply a Linux kernel update that includes the ims-pcu response-length validation fix. The referenced stable kernel commits contain the fix.