The Linux kernel’s Intel Mobile System PMU (ims‑pcu) USB host controller driver assumes that the first endpoint of a control interface is an interrupt IN endpoint and does not verify the endpoint type. A malicious USB device can advertise a different endpoint type; when that type is passed to usb_fill_int_urb() the driver uses the wrong API for the data, which can cause kernel warnings or undefined behavior such as data corruption, hangs, or kernel crashes. The flaw demonstrates improper input validation and improper handling of array data (CWE‑1287).

Any Linux system running a kernel that contains the ims‑pcu driver without the recent patch is vulnerable. The vendor advisory does not list specific kernel revisions; all kernels that lack the added validation check must be considered at risk until the patch is applied and verified. Once the patch is installed, the driver checks that the control endpoint is indeed an interrupt IN endpoint before calling usb_fill_int_urb()

The CVSS score of 5.5 indicates moderate severity. The EPSS score is reported as less than 1%, and the flaw is not in the CISA KEV catalog, suggesting low current exploitation probability. However, an attacker requires physical access to connect a crafted USB device that advertises a non‑interrupt-in endpoint. If such a device is connected, the driver may invoke usb_fill_int_urb() incorrectly, triggering kernel warnings or leading to undefined kernel behavior. The risk remains significant for hosts that are unable to apply the patch promptly.