Bug 2525487 (CVE-2026-80596) - CVE-2026-80596 kernel: Input: ims-pcu - only expose sysfs attributes on control interface
Summary: CVE-2026-80596 kernel: Input: ims-pcu - only expose sysfs attributes on contr...
Keywords:
Status: NEW
Alias: CVE-2026-80596
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-28 07:47 UTC by OSIDB Bzimport
Modified: 2026-09-03 15:54 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-28 07:47:31 UTC
In the Linux kernel, the following vulnerability has been resolved:

Input: ims-pcu - only expose sysfs attributes on control interface

When the driver was converted to use the driver core to instantiate device
attributes (via .dev_groups in the usb_driver structure), the attributes
started appearing on all interfaces bound to the driver. Since the ims-pcu
driver manually claims the secondary data interface during probe, the
driver core automatically creates the sysfs attributes for that interface
as well.

However, the driver only supports these attributes on the primary control
interface. Data interfaces lack the necessary descriptors and internal
state to handle these requests, and accessing them can lead to unexpected
behavior or crashes.

Fix this by updating the is_visible() callbacks for both the main and OFN
attribute groups to verify that the interface being accessed is indeed the
control interface.


Note You need to log in before you can comment on or make changes to this bug.