In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - only expose sysfs attributes on control interface When the driver was converted to use the driver core to instantiate device attributes (via .dev_groups in the usb_driver structure), the attributes started appearing on all interfaces bound to the driver. Since the ims-pcu driver manually claims the secondary data interface during probe, the driver core automatically creates the sysfs attributes for that interface as well. However, the driver only supports these attributes on the primary control interface. Data interfaces lack the necessary descriptors and internal state to handle these requests, and accessing them can lead to unexpected behavior or crashes. Fix this by updating the is_visible() callbacks for both the main and OFN attribute groups to verify that the interface being accessed is indeed the control interface.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-80596 is a high-severity vulnerability in the Linux kernel's IMS-PCU driver that exposes sensitive sysfs attributes on unintended interfaces. When the driver was refactored to use the driver core's device attribute instantiation mechanism (.dev_groups), the sysfs attributes began appearing on all interfaces bound to the driver, including secondary data interfaces that should remain unexposed. This creates an information disclosure risk and potential attack surface expansion, affecting systems running vulnerable Linux kernels with the IMS-PCU driver active—particularly industrial, medical, and embedded systems utilizing IMS touchscreen controllers.
While this CVE currently maps to zero MITRE ATT&CK techniques and zero Casky skills, practitioners using Casky.ai would benefit from monitoring for related defensive patterns. The underlying issue reflects improper access control and information exposure (CWE class concerns), which align with reconnaissance and discovery phases of attack chains. Security teams should watch for: (1) anomalous sysfs file enumeration attempts on USB device interfaces, (2) unauthorized attribute access from unprivileged processes, and (3) lateral movement patterns exploiting exposed kernel interface information. Practitioners would identify this vulnerability through kernel version assessment, driver configuration audits, and USB interface permission reviews—foundational hardening practices that Casky's extended reasoning capabilities help contextualize within broader threat landscapes.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-80596. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation