CVE-2026-64565

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()

The `ims_pcu_process_data()` processes incoming URB data byte by byte.

However, it fails to check if the `read_pos` index exceeds

IMS_PCU_BUF_SIZE.

If a malicious USB device sends a packet larger than IMS_PCU_BUF_SIZE,

`read_pos` will increment indefinitely. Moreover, since `read_pos` is

located immediately after `read_buf`, the attacker can overwrite

`read_pos` itself to arbitrarily control the index.

This manipulated `read_pos` is subsequently used in

`ims_pcu_handle_response()` to copy data into `cmd_buf`, leading to a

heap buffer overflow.

Specifically, an attacker can overwrite the `cmd_done.wait.head` located

at offset 136 relative to `cmd_buf` in the `ims_pcu_handle_response()`.

Consequently, when the driver calls `complete(&pcu->cmd_done)`, it

triggers a control flow hijack by using the manipulated pointer.

Fix this by adding a bounds che

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References