Heap Buffer Overflow in Linux Kernel Affected by Malicious USB Device

CVE-2026-64565

What is CVE-2026-64565?

A vulnerability has been identified in the Linux kernel concerning the ims_pcu_process_data() function that processes incoming data from USB devices. The issue lies in the failure to validate the read_pos index against the maximum buffer size, IMS_PCU_BUF_SIZE. If an attacker sends a packet larger than this size, it causes read_pos to increment without bounds, potentially allowing the attacker to influence the location of the index itself. This can lead to a heap buffer overflow when ims_pcu_handle_response() copies data to cmd_buf, allowing the attacker to manipulate memory and execute arbitrary code. To mitigate this risk, a bounds check for read_pos has been implemented to prevent the processing of oversized packets.

References