CVE-2026-72074 Linux CVE debrief

Who should care

Linux kernel developers, Linux distribution maintainers, and users of affected systems should be aware of this vulnerability and take necessary actions to protect their systems. This includes reviewing and applying patches, monitoring system updates, and verifying the security of their deployments. Operators, platform administrators, vulnerability management teams, and security teams may be impacted by this vulnerability and should take appropriate measures.

Technical summary

The ims-pcu driver in the Linux kernel fails to validate the control interface in CDC union descriptors. This oversight could allow an attacker to overwrite data, potentially leading to security issues. The driver must verify that the bMasterInterface0 matches the interface being probed to prevent data overwrite. Affected users should review and apply patches, monitor system updates, and verify the security of their deployments.

Defensive priority

Validate and verify interface probing to prevent potential data overwrite.

Recommended defensive actions

• Verify interface probing in the ims-pcu driver
• Validate control interface in CDC union descriptors
• Monitor Linux kernel updates for patches
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The Linux kernel's ims-pcu driver lacks validation for the control interface found in the CDC union descriptor. Limited information available; further review needed. The driver does not verify that the bMasterInterface0 matches the interface being probed, potentially allowing a driver to overwrite the private data of another interface. This could lead to security issues if exploited. Defenders should verify interface probing and control interface validation in the ims-pcu driver.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.