CVE-2026-80768

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the HID ft260 driver during I2C read operations. The function ft260 i2c read() assigns dev->read buf to a caller-supplied buffer, typically an on-stack variable. Simultaneously, the HID input callback ft260 raw event() operates in the input/IRQ path and copies device-supplied payloads into dev->read buf after a NULL check. Because read buf, read idx, and read len are shared without proper serialization, a timeout in ft260 i2c read() can lead to the stack frame being unwound while ft260 raw event() still attempts to write to that memory location. This results in a stack-use-after-return write, which can be triggered by malicious or malfunctioning hardware.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.