CVE-2026-72078Input: ims-pcu - validate control endpoint type
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - validate control endpoint type The driver currently assumes that the first endpoint of the control interface is an interrupt IN endpoint without verifying it. A malicious device could provide a different endpoint type, which would then be passed to usb_fill_int_urb(), potentially leading to kernel warnings or undefined behavior. Verify that the control endpoint is an interrupt IN endpoint.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 628329d52474323938a03826941e166bc7c8eff4 builds before 5de5075a1f26166f172b6687cb66810a9b61e3eb; 628329d52474323938a03826941e166bc7c8eff4 builds before 7960d99332e03705ec622d92f31e0c77de8baac6; 628329d52474323938a03826941e166bc7c8eff4 builds before 5b96b4da96313dd799a3a40dcfd598d2e2c19217; from 628329d52474323938a03826941e166bc7c8eff4 before aa1885f87e60c80e59e50ffd5fb096bf02c83e05; from 628329d52474323938a03826941e166bc7c8eff4 before a630508a09b0c05f14bc0843ed409221a93751aa; from 628329d52474323938a03826941e166bc7c8eff4 before c8d3d83f2eaaf7659de76e8d44e8fc88ee346042; from 628329d52474323938a03826941e166bc7c8eff4 before cbfa059dfb48b9aa322e34fd44a093d9ca29ad7e; from 628329d52474323938a03826941e166bc7c8eff4 before baf56975806534268e24acf9a8abb1c447ce11e9 | CNA record |
References
- https://git.kernel.org/stable/c/5de5075a1f26166f172b6687cb66810a9b61e3eb
- https://git.kernel.org/stable/c/7960d99332e03705ec622d92f31e0c77de8baac6
- https://git.kernel.org/stable/c/5b96b4da96313dd799a3a40dcfd598d2e2c19217
- https://git.kernel.org/stable/c/aa1885f87e60c80e59e50ffd5fb096bf02c83e05
- https://git.kernel.org/stable/c/a630508a09b0c05f14bc0843ed409221a93751aa
- https://git.kernel.org/stable/c/c8d3d83f2eaaf7659de76e8d44e8fc88ee346042
- https://git.kernel.org/stable/c/cbfa059dfb48b9aa322e34fd44a093d9ca29ad7e
- https://git.kernel.org/stable/c/baf56975806534268e24acf9a8abb1c447ce11e9
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.