CVE-2026-80596

The Linux kernel's ims-pcu driver, which supports IMS Passenger Control Unit USB input devices, incorrectly exposes its sysfs attribute groups on all USB interfaces bound to the driver after a refactor that moved attribute creation into the driver core (.dev_groups), including the secondary data interface that lacks the descriptors and internal state to handle these requests. A local, unprivileged user with no user interaction required can read or write the attributes exposed on the data interface, triggering unexpected behavior or a kernel crash. Per the CVSS vector (AV:L/PR:N/UI:N with high C/I/A), an attacker gains local code-execution-free crash/impact potential rated high across confidentiality, integrity, and availability. Only systems running affected Linux kernels with the ims-pcu driver loaded and an IMS Passenger Control Unit device attached are affected; the vast majority of Linux deployments without this niche hardware are unaffected. No public proof-of-concept, KEV listing, or known exploitation exists, and EPSS estimates only a 0.1% probability of exploitation in the next 30 days.

What to do: Apply the upstream kernel patch titled 'Input: ims-pcu - only expose sysfs attributes on control interface' or move to a kernel release that includes it; no fixed version number was provided in the available data. As an interim mitigation, check whether the ims-pcu module is loaded (lsmod | grep ims-pcu) and, if the IMS Passenger Control Unit device is not required, unload or blacklist the driver; organizations without this hardware need take no action.