CVE-2026-64565

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A heap buffer overflow exists in the ims-pcu component. The function ims pcu process data() processes incoming URB data byte by byte but does not verify if the read pos index exceeds IMS PCU BUF SIZE. A malicious USB device can send a packet larger than IMS PCU BUF SIZE, causing read pos to increment indefinitely and overwrite itself, allowing an attacker to control the index. This manipulated read pos is then used in ims pcu handle response() to copy data into cmd buf, resulting in a heap buffer overflow. Specifically, an attacker can overwrite cmd done.wait.head at offset 136 relative to cmd buf. When the driver executes the complete() function, it can lead to a control flow hijack via the manipulated pointer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.