Executive brief
The IMS-PCU input device driver in the Linux kernel exposes sysfs control attributes on all USB interfaces bound to the driver, including secondary data interfaces that lack the necessary state to handle requests. An attacker or local user with access to sysfs can trigger unexpected behavior or kernel crashes by accessing these attributes on the wrong interface, disrupting input device functionality or causing denial of service.
Technical details
The vulnerability is a logic error in the ims-pcu USB input device driver (drivers/input/misc/ims-pcu.c). When the driver was refactored to use the driver core's .dev_groups mechanism to instantiate device attributes, sysfs attributes began appearing on all interfaces claimed by the driver, including secondary data interfaces. The driver internally claims a secondary data interface during probe, but that interface lacks the descriptors and internal state (`ctrl_intf`) required to safely handle attribute requests. The fix adds interface validation checks in the `ims_pcu_is_attr_visible()` and `ims_pcu_ofn_is_attr_visible()` callbacks to return 0 or `SYSFS_GROUP_INVISIBLE` when the accessed interface does not match `pcu->ctrl_intf`. No authentication is required; local sysfs access is sufficient to trigger the issue. The patch was committed upstream on 2026-05-31 and backported to stable kernels by 2026-07-24.
Affected products
- Linux Linux kernel prior to 2026-05-31
Timeline
- 2026-08-28: disclosed
- 2026-05-31: patched: upstream commit 001428ea4d2c371107cb984108e266adf99f1f1e
- 2026-07-24: patched: backported to stable kernels