CVE-2026-72075 Input: ims-pcu - fix race condition in reset_device sysfs callback
A race condition in the Linux kernel ims-pcu driver allows local attackers to corrupt shared command buffers, potentially causing system instability or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72075?
CVE-2026-72075 is a vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Input: ims-pcu - fix race condition in reset_device sysfs callback
The ims_pcu_reset_device() sysfs callback calls ims_pcu_execute_command() without acquiring pcu->cmd_mutex. This can lead to data races and corruption of the shared command buffer if triggered concurrently with other commands.
Acquire pcu->cmd_mutex before calling ims_pcu_execute_command().
Which versions are affected by CVE-2026-72075?
How do I fix CVE-2026-72075?
Apply the vendor's patch.
Is CVE-2026-72075 being exploited?
There is no known exploitation of CVE-2026-72075 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72075, DEBIAN-CVE-2026-72075, GHSA-h7gg-4wfx-9hw5, UBUNTU-CVE-2026-72075.