vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-72078

Input: ims-pcu - validate control endpoint type

N/A
Published: August 15, 2026 at 05:52 AM UTC
Updated: August 17, 2026 at 06:18 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - validate control endpoint type The driver currently assumes that the first endpoint of the control interface is an interrupt IN endpoint without verifying it. A malicious device could provide a different endpoint type, which would then be passed to usb_fill_int_urb(), potentially leading to kernel warnings or undefined behavior. Verify that the control endpoint is an interrupt IN endpoint.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
95%
3.10 ≤ v < 5.10.2613.10 ≤ v < 5.15.2123.10 ≤ v < 6.1.1783.10 ≤ v < 6.12.973.10 ≤ v < 6.18.403.10 ≤ v < 6.6.1453.10 ≤ v < 7.1.53.10 ≤ v < 7.23.10628329d52474323938a03826941e166bc7c8eff4
Vendor states this is fixed in 5b96b4da96313dd799a3a40dcfd598d2e2c19217 (fixed)
Vendor states this is fixed in 5de5075a1f26166f172b6687cb66810a9b61e3eb (fixed)
Vendor states this is fixed in 7960d99332e03705ec622d92f31e0c77de8baac6 (fixed)
Vendor states this is fixed in a630508a09b0c05f14bc0843ed409221a93751aa (fixed)
Vendor states this is fixed in aa1885f87e60c80e59e50ffd5fb096bf02c83e05 (fixed)
Vendor states this is fixed in baf56975806534268e24acf9a8abb1c447ce11e9 (fixed)
Vendor states this is fixed in c8d3d83f2eaaf7659de76e8d44e8fc88ee346042 (fixed)
Vendor states this is fixed in cbfa059dfb48b9aa322e34fd44a093d9ca29ad7e (fixed)
Vendor states this is fixed in 3.10 (unaffected)
Vendor states this is fixed in 5.10.261 (unaffected)
Vendor states this is fixed in 5.15.212 (unaffected)
Vendor states this is fixed in 6.1.178 (unaffected)
Vendor states this is fixed in 6.12.97 (unaffected)
Vendor states this is fixed in 6.18.40 (unaffected)
Vendor states this is fixed in 6.6.145 (unaffected)
Vendor states this is fixed in 7.1.5 (unaffected)
Vendor states this is fixed in 7.2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (8)

Source: cverecord
https://git.kernel.org/stable/c/5de5075a1f26166f172b6687cb66810a9b61e3eb
Source: cverecord
https://git.kernel.org/stable/c/7960d99332e03705ec622d92f31e0c77de8baac6
Source: cverecord
https://git.kernel.org/stable/c/5b96b4da96313dd799a3a40dcfd598d2e2c19217
Source: cverecord
https://git.kernel.org/stable/c/aa1885f87e60c80e59e50ffd5fb096bf02c83e05
Source: cverecord
https://git.kernel.org/stable/c/a630508a09b0c05f14bc0843ed409221a93751aa
Source: cverecord
https://git.kernel.org/stable/c/c8d3d83f2eaaf7659de76e8d44e8fc88ee346042
Source: cverecord
https://git.kernel.org/stable/c/cbfa059dfb48b9aa322e34fd44a093d9ca29ad7e
Source: cverecord
https://git.kernel.org/stable/c/baf56975806534268e24acf9a8abb1c447ce11e9

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card