A vulnerability in the Linux kernel ims-pcu driver allows local, unprivileged access to sensitive sysfs attributes, posing a high risk of system crashes and potential unauthorized state manipulation.

The vulnerability exists because the ims-pcu driver incorrectly exposes sysfs attributes on secondary data interfaces. An attacker with local access can interact with these attributes, which lack the required internal state handling, leading to unexpected behavior or system crashes.

The exploit allows a local user to induce system instability or crashes, resulting in denial of service for critical infrastructure. While the CVSS score of 8.4 indicates a high severity, the requirement for local access somewhat constrains the attack surface. However, in multi-user environments or shared hosting, this vulnerability could be leveraged to disrupt operations or potentially escalate privileges through memory corruption.

Immediate Action: Update the Linux kernel to version 6.12.97, 6.18.40, 7.1.5, or later, as these versions contain the necessary fixes for the ims-pcu driver.

Proactive Monitoring: Monitor system logs for repeated crash events or unusual kernel-related errors originating from the ims-pcu driver or related USB input device interfaces.

Compensating Controls: Restrict physical or local shell access to the system to untrusted users, as the vulnerability requires local interaction to trigger the improper attribute exposure.

Public Exploit Available: Unknown

Given the high CVSS severity and the potential for system-wide instability, administrators should prioritize updating kernel packages to the patched versions provided. Ensure that all production environments running Linux kernel version 6.11 are included in the immediate patch cycle to eliminate the risk of local exploitation.