CVE-2026-72074: Input: ims-pcu - fix type confusion in CDC union descriptor parsing

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Input: ims-pcu - fix type confusion in CDC union descriptor parsing

The driver currently trusts the bMasterInterface0 from the CDC union
descriptor without verifying that it matches the interface being
probed. This could lead to the driver overwriting the private data of
another interface.

Validate that the control interface found in the descriptor is indeed
the one we are probing.

The Linux kernel CVE team has assigned CVE-2026-72074 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.10 with commit 628329d52474323938a03826941e166bc7c8eff4 and fixed in 5.10.261 with commit ab87cd7789d00f441f60a016cbcff35abe76513c
	Issue introduced in 3.10 with commit 628329d52474323938a03826941e166bc7c8eff4 and fixed in 5.15.212 with commit b5518c5632f3485849421b9c33b4db5ae6a54ed7
	Issue introduced in 3.10 with commit 628329d52474323938a03826941e166bc7c8eff4 and fixed in 6.1.178 with commit 163c3e7a1de6b3d5c85edb3bdf4cf087382103b0
	Issue introduced in 3.10 with commit 628329d52474323938a03826941e166bc7c8eff4 and fixed in 6.6.145 with commit 08bf4b6ee28987570f4b3f1954427621fa291bf5
	Issue introduced in 3.10 with commit 628329d52474323938a03826941e166bc7c8eff4 and fixed in 6.12.97 with commit fa7f65c5315a25b310daae69ab527efd420e37fa
	Issue introduced in 3.10 with commit 628329d52474323938a03826941e166bc7c8eff4 and fixed in 6.18.40 with commit 0e8115a7ed9a99ff9495615a575a6c0f43566d10
	Issue introduced in 3.10 with commit 628329d52474323938a03826941e166bc7c8eff4 and fixed in 7.1.5 with commit f4cf878dcc4f6f02e7a25294bfaed4361264995e
	Issue introduced in 3.10 with commit 628329d52474323938a03826941e166bc7c8eff4 and fixed in 7.2-rc1 with commit ca459e237bc49567649c56bc72e4c602fb92fd67

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72074
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/input/misc/ims-pcu.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ab87cd7789d00f441f60a016cbcff35abe76513c
	https://git.kernel.org/stable/c/b5518c5632f3485849421b9c33b4db5ae6a54ed7
	https://git.kernel.org/stable/c/163c3e7a1de6b3d5c85edb3bdf4cf087382103b0
	https://git.kernel.org/stable/c/08bf4b6ee28987570f4b3f1954427621fa291bf5
	https://git.kernel.org/stable/c/fa7f65c5315a25b310daae69ab527efd420e37fa
	https://git.kernel.org/stable/c/0e8115a7ed9a99ff9495615a575a6c0f43566d10
	https://git.kernel.org/stable/c/f4cf878dcc4f6f02e7a25294bfaed4361264995e
	https://git.kernel.org/stable/c/ca459e237bc49567649c56bc72e4c602fb92fd67