In the Linux kernel, the IMS‑PCU USB driver was changed to use the driver core to instantiate sysfs attributes, causing those attributes to appear on every interface the driver was bound to. Because the driver explicitly claims the secondary data interface during probe, the kernel automatically creates sysfs entries for that interface, even though the driver only supports the attributes on the primary control interface. Data interfaces lack the descriptors and internal state required to handle the attribute requests, so accessing them can result in unexpected behavior or kernel crashes. The weakness lies in an absence of proper visibility checks for sysfs nodes, classified as CWE‑908.

Linux kernel configurations that include the IMS‑PCU driver, which is present in most standard kernel builds, are affected. The flaw is confined to the kernel module that implements the driver; other subsystems are not impacted.

The CVSS score of 8.4 signals high severity, while the EPSS score of less than 1 % indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the sysfs entries are accessible from user space on any system with the driver loaded, so the likely attack vector is local user‑level interaction with those nodes, which could trigger a crash and cause a denial‑of‑service condition. There is no privilege escalation risk, but the resulting service interruption could enable further attacks if the device is critical to operations.