Description

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - only expose sysfs attributes on control interface When the driver was converted to use the driver core to instantiate device attributes (via .dev_groups in the usb_driver structure), the attributes started appearing on all interfaces bound to the driver. Since the ims-pcu driver manually claims the secondary data interface during probe, the driver core automatically creates the sysfs attributes for that interface as well. However, the driver only supports these attributes on the primary control interface. Data interfaces lack the necessary descriptors and internal state to handle these requests, and accessing them can lead to unexpected behavior or crashes. Fix this by updating the is_visible() callbacks for both the main and OFN attribute groups to verify that the interface being accessed is indeed the control interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-28T08:16:43.320Z",
  "pubdate": "2026-08-28T08:16:43.320Z",
  "executiveSummary": "The Linux kernel ims-pcu driver suffers from an improper access control vulnerability resulting from incorrect sysfs attribute exposure. The vulnerability exists because the driver, after migrating to the driver core's .dev_groups mechanism, incorrectly exposes sysfs attributes to all interfaces bound to the driver, including secondary data interfaces that lack the necessary state management and descriptor support.\nThe vulnerability allows for unauthorized interaction with sysfs attributes that are intended solely for the primary control interface. An attacker or a local user with sufficient permissions could target the exposed attributes on the secondary interface, leading to unexpected behavior, kernel state corruption, or system crashes due to the driver's inability to handle requests on interfaces lacking internal support.\nThis represents a privilege escalation or denial-of-service risk, as the improper exposure allows interaction with kernel-level interfaces that were not intended for external or user-space consumption via the data interface. Successful exploitation typically requires local access to the system to interact with the sysfs filesystem. The vulnerability is restricted to the local machine context and requires existing access to the device node or filesystem representation of the ims-pcu driver.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the .dev_groups attribute management within the ims-pcu driver. When the driver was updated to leverage the kernel's driver core for managing device attributes, it failed to adequately restrict the visibility of these attributes. Because the ims-pcu driver manually claims a secondary data interface during the probe sequence, the driver core automatically instantiated the defined sysfs attribute groups for both the primary control interface and the secondary data interface.\nThe underlying vulnerability is an interface mismatch. The primary control interface contains the necessary descriptors and internal state structures (e.g., initialized mutexes, data buffers, and operational state trackers) to process sysfs attribute read/write requests. In contrast, the secondary data interface is strictly intended for asynchronous data transmission and lacks the backend initialization required to interpret control requests.\nThe attack flow proceeds as follows: 1) An attacker identifies the presence of the ims-pcu driver via sysfs nodes (typically /sys/bus/usb/devices/...). 2) The attacker enumerates the interfaces associated with the device and identifies the secondary data interface. 3) Due to the lack of attribute visibility controls, the same sysfs files created for the primary control interface exist for the data interface. 4) The attacker performs read or write operations on these attributes through the secondary interface. 5) The kernel driver receives a call to an attribute handler (e.g., show or store functions) triggered via the data interface. 6) The handler, expecting the state associated with the control interface, attempts to access uninitialized or incorrect internal state structures, resulting in null pointer dereferences, heap corruption, or race conditions.\nThe payload behavior involves interacting with specific attribute files that expect operational device state. By triggering these paths, an attacker can induce a kernel panic or a denial-of-service condition. Furthermore, if the attribute handlers perform logic based on device-specific structures that are incorrectly mapped, it may allow for unauthorized manipulation of the device's operational parameters, potentially impacting the hardware's behavior or persistence across reboots. This is essentially a case of improper sanitization of interface-specific attribute visibility, where the kernel fails to validate the context of the calling device object before executing sensitive code paths."
}