# CVE-2026-64565: CVE-2026-64565

Status: published. Published: 2026-08-04. Updated: 2026-11-03.

In the Linux kernel, the following vulnerability has been resolved:

Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()

The `ims_pcu_process_data()` processes incoming URB data byte by byte.
However, it fails to check if the `read_pos` index exceeds
IMS_PCU_BUF_SIZE.

If a malicious USB device sends a packet larger than IMS_PCU_BUF_SIZE,
`read_pos` will increment indefinitely. Moreover, since `read_pos` is
located immediately after `read_buf`, the attacker can overwrite
`read_pos` itself to arbitrarily control the index.

This manipulated `read_pos` is subsequently used in
`ims_pcu_handle_response()` to copy data into `cmd_buf`, leading to a
heap buffer overflow.

Specifically, an attacker can overwrite the `cmd_done.wait.head` located
at offset 136 relative to `cmd_buf` in the `ims_pcu_handle_response()`.
Consequently, when the driver calls `complete(&pcu->cmd_done)`, it
triggers a control flow hijack by using the manipulated pointer.

Fix this by adding a bounds check for `read_pos` before writing to
`read_buf`. If the packet is too long, discard it, log a warning,
and reset the parser state.

[dtor: factor out resetting packet state, reset checksum as well]

## Remediation

No remediation reported in collected sources

## Affected products and versions

Not reported in collected sources.

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: Not reported

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/06cfff93fd40441292567b999091beab11c74504 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/3a801bc75ba1d121d0ed60e7234f93ba5651d87d (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/40bbbf2e91fd60715525bf0405c67876af817edf (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/875115b82c295277b81b6dfee7debc725f44e854 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/992a7173364dcf63e30012af43da3c2f279839f9 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/ca9f8c09845fb8c51b6d447f6428eecd1b8b0a49 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/d03a740e087de7dcb2a26dc1123377bd3d1d84ca (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

## Provenance

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-64565; retrieved 2026-11-03; source updated 2026-11-03

Revision: bb29a77ff6d54c3884aa1e63423d84adc3cbd4f7df7925e7981ec81913b17eed

Canonical: https://y2.dev/cve/CVE-2026-64565

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.