CVE-2026-80594
Received Received - Intake

Buffer Overflow in Linux Kernel USB CDC Driver

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing The driver parses CDC union descriptors in ims_pcu_get_cdc_union_desc() by iterating through the extra descriptor data. However, it does not verify that the bLength of each descriptor is at least 2. A malicious device could provide a descriptor with bLength = 0, leading to an infinite loop in the driver. Add a check to ensure bLength is at least 2 before proceeding with parsing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-28
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-80594
EUVD
EUVD-2026-67470

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel driver ims-pcu. It involves a potential infinite loop during CDC union descriptor parsing. The driver fails to check if the descriptor length (bLength) is at least 2 before processing, allowing a malicious device to provide a descriptor with bLength=0 and cause an infinite loop.

Detection Guidance

This vulnerability involves a potential infinite loop in the Linux kernel driver ims-pcu due to improper parsing of CDC union descriptors. Detection requires checking if the affected driver is loaded and examining descriptor parsing behavior. Use commands like lsmod to check for ims_pcu, dmesg for kernel logs, and inspect USB device descriptors with lsusb -v. Monitor system logs for unusual CPU usage or hangs during USB device insertion.

Impact Analysis

This vulnerability could cause system hangs or freezes if a malicious USB device is connected. The infinite loop may consume CPU resources, making the system unresponsive until the device is disconnected or the system is rebooted.

Mitigation Strategies

Apply the Linux kernel patch that adds a check for bLength >= 2 in ims_pcu_get_cdc_union_desc(). Update to a kernel version containing this fix. If immediate patching is not possible, consider disabling the ims_pcu driver module temporarily or restricting access to untrusted USB devices until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80594. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart