HIGH Introduced in 6.11
ims-pcu SysfsAttr Panic
CVE-2026-80596
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - only expose sysfs attributes on control interface When the driver was converted to use the driver core to instantiate device attributes (via .dev_groups in the usb_driver structure), the attributes started appearing on all interfaces bound to the driver. Since the ims-pcu driver manually claims the secondary data interface during probe, the driver core automatically creates the sysfs attributes for that interface as well. However, the driver only supports these attributes on the primary control interface. Data interfaces lack the necessary descriptors and internal state to handle these requests, and accessing them can lead to unexpected behavior or crashes. Fix this by updating the is_visible() callbacks for both the main and OFN attribute groups to verify that the interface being accessed is indeed the control interface.
02KernelScan AI Analysis
Risk summary
A local user with access to sysfs can trigger kernel crashes by reading or writing driver-specific sysfs attributes on the secondary USB data interface of an ims-pcu device. The bug is limited to systems with the specific hardware and driver loaded.
Vulnerability analysis
The ims-pcu USB driver exposes sysfs control attributes on both its primary control interface and its secondary data interface after a refactor that let the driver core create attributes on all bound interfaces. The data interface lacks the descriptors and internal state needed to service those attribute reads and writes, so accessing them can cause unexpected behavior or kernel crashes. The fix updates the attribute visibility callbacks so the attributes are only exposed on the control interface, hiding them entirely on the data interface. This is reachable by any local user who can access sysfs on a system where the ims-pcu driver is bound to the device.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.11 | 6.12.97 | 7d5e7c8d48f0 |
| 6.18 | 6.11 | 6.18.40 | 87e2f89dea07 |
| 7.1 | 6.11 | 7.1.5 | 73e6687be0c1 |
| mainline | 6.11 | 7.2 | 001428ea4d2c |
| cip/6.12 | 6.11 | 6.12.101-cip29 | 7d5e7c8d48f0 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.101-cip29 |