A heap buffer overflow occurs in the Linux kernel’s USB IMS PCU driver when the driver processes incoming USB data byte by byte in `ims_pcu_process_data()` without ensuring that the `read_pos` index remains within the fixed-size buffer. If a malicious USB device sends a packet larger than the buffer, `read_pos` increments beyond the buffer limit and can overwrite the adjacent `read_pos` variable itself, allowing an attacker to place an arbitrary value in that index. This corrupted index is later used by `ims_pcu_handle_response()` to copy data into a command buffer, leading to a heap buffer overflow that can overwrite the `cmd_done.wait.head` pointer. The overwritten pointer is then used when the driver calls `complete(&pcu->cmd_done)`, enabling a control flow hijack that can execute arbitrary code with kernel privileges.

The flaw resides in the Linux kernel’s USB IMS PCU driver code, affecting all Linux operating systems that include this legacy USB PCU handling code in their kernel build. No specific kernel version numbers are supplied, so any installation that contains the unpatched `ims_pcu` driver could potentially be impacted, including all generic Linux distributions that ship the default kernel.

The CVSS score is not provided, and the EPSS score is currently unavailable, but the exploit requires a malicious USB device and direct physical or logical access to the target system. The vulnerability is not listed in CISA’s KEV catalog, indicating no known mass exploitation at this time. Nevertheless, the combination of a heap overflow and control‑flow hijack represents a high‑severity vulnerability that can lead to remote code execution if an attacker can supply malicious USB traffic.