Strix
57.2K

CVE-2026-72078

UnknownEPSS 0.22%

Last modified

CVE-2026-72078 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - validate control endpoint type The driver currently assumes that the first endpoint of the control interface is an interrupt IN endpoint without verifying it. A malicious device could provide a different endpoint type, which would then be passed to usb_fill_int_urb(), potentially leading to kernel warnings or undefined behavior. Verify that the control endpoint is an interrupt IN endpoint.. EPSS estimates a 0.22% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - validate control endpoint type The driver currently assumes that the first endpoint of the control interface is an interrupt IN endpoint without verifying it. A malicious device could provide a different endpoint type, which would then be passed to usb_fill_int_urb(), potentially leading to kernel warnings or undefined behavior. Verify that the control endpoint is an interrupt IN endpoint.

Metrics

EPSS Probability
0.22%

12.8th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 628329d52474323938a03826941e166bc7c8eff4, < 5de5075a1f26166f172b6687cb66810a9b61e3eb; >= 628329d52474323938a03826941e166bc7c8eff4, < 7960d99332e03705ec622d92f31e0c77de8baac6; >= 628329d52474323938a03826941e166bc7c8eff4, < 5b96b4da96313dd799a3a40dcfd598d2e2c19217; >= 628329d52474323938a03826941e166bc7c8eff4, < aa1885f87e60c80e59e50ffd5fb096bf02c83e05; >= 628329d52474323938a03826941e166bc7c8eff4, < a630508a09b0c05f14bc0843ed409221a93751aa; >= 628329d52474323938a03826941e166bc7c8eff4, < c8d3d83f2eaaf7659de76e8d44e8fc88ee346042; >= 628329d52474323938a03826941e166bc7c8eff4, < cbfa059dfb48b9aa322e34fd44a093d9ca29ad7e; >= 628329d52474323938a03826941e166bc7c8eff4, < baf56975806534268e24acf9a8abb1c447ce11e9
LinuxLinux3.10

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-72078?
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - validate control endpoint type The driver currently assumes that the first endpoint of the control interface is an interrupt IN endpoint without verifying it. A malicious device could provide a different endpoint type, which would then be passed to usb_fill_int_urb(), potentially leading to kernel warnings or undefined behavior. Verify that the control endpoint is an interrupt IN endpoint.
How severe is CVE-2026-72078?
Severity scoring for CVE-2026-72078 is pending analysis. The EPSS model estimates a 0.22% probability of exploitation in the next 30 days.
How do I fix CVE-2026-72078?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-72078?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST