CVE-2026-64565
Received Received - Intake

Heap Buffer Overflow in Linux Kernel ims-pcu Driver

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() The `ims_pcu_process_data()` processes incoming URB data byte by byte. However, it fails to check if the `read_pos` index exceeds IMS_PCU_BUF_SIZE. If a malicious USB device sends a packet larger than IMS_PCU_BUF_SIZE, `read_pos` will increment indefinitely. Moreover, since `read_pos` is located immediately after `read_buf`, the attacker can overwrite `read_pos` itself to arbitrarily control the index. This manipulated `read_pos` is subsequently used in `ims_pcu_handle_response()` to copy data into `cmd_buf`, leading to a heap buffer overflow. Specifically, an attacker can overwrite the `cmd_done.wait.head` located at offset 136 relative to `cmd_buf` in the `ims_pcu_handle_response()`. Consequently, when the driver calls `complete(&pcu->cmd_done)`, it triggers a control flow hijack by using the manipulated pointer. Fix this by adding a bounds check for `read_pos` before writing to `read_buf`. If the packet is too long, discard it, log a warning, and reset the parser state. [dtor: factor out resetting packet state, reset checksum as well]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-64565
EUVD
EUVD-2026-52606

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap buffer overflow vulnerability in the Linux kernel's ims-pcu driver. The issue occurs in the ims_pcu_process_data() function which processes USB data byte by byte without checking if the read_pos index exceeds the buffer size (IMS_PCU_BUF_SIZE). A malicious USB device can send oversized packets to manipulate read_pos, potentially overwriting it to control memory access. This manipulated index is later used in ims_pcu_handle_response() to copy data, leading to a heap buffer overflow that could enable control flow hijacking.

Detection Guidance

This vulnerability is specific to USB device handling in the Linux kernel and requires checking for heap buffer overflows in the ims-pcu driver. Monitor kernel logs for warnings or errors related to ims_pcu_process_data or heap corruption. Use commands like dmesg | grep ims_pcu or journalctl -k | grep ims_pcu to detect suspicious activity.

Impact Analysis

If exploited, this vulnerability could allow an attacker with physical access to a system to execute arbitrary code with kernel privileges by connecting a malicious USB device. This could lead to system compromise, data theft, or denial of service. Systems using vulnerable Linux kernel versions with the ims-pcu driver are at risk.

Compliance Impact

This vulnerability involves a heap buffer overflow in the Linux kernel's ims-pcu driver, which could allow arbitrary code execution or denial of service. Such vulnerabilities may impact compliance with GDPR by compromising data integrity or availability, and with HIPAA by potentially exposing or altering sensitive health information if exploited on systems handling protected data.

Mitigation Strategies

Update your Linux kernel to the latest patched version to ensure the fix for CVE-2026-64565 is applied. Avoid using untrusted USB devices until the system is updated. If immediate patching is not possible, disable the ims-pcu driver module if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64565. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart