PT-2026-82191 · Linux · Linux Kernel

CVE-2026-80575

·

Published

2026-08-26

·

Updated

2026-08-29

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)
Description An issue exists in the cs40l50 add() function where custom data from an FF PERIODIC or FF CUSTOM effect is copied from user space via EVIOCSFF without sufficient validation of the custom len variable. This leads to several memory safety issues:
  • If custom len is 0, memdup array user() returns a ZERO SIZE PTR, which is subsequently dereferenced when accessing custom data[0] in cs40l50 effect bank set().
  • If custom len is 1, only two bytes are allocated, causing an out-of-bounds read when custom data[1] is accessed in cs40l50 effect index set().
  • The bank value is stored in an s16 (signed 16-bit integer) after being masked with CS40L50 CUSTOM DATA MASK. Values of 0x8000 or higher wrap to negative numbers, bypassing the bank type >= CS40L50 WVFRM BANK NUM check and allowing an out-of-bounds index into the vib->dsp.banks[] array.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

CVE-2026-80575

Affected Products

Linux Kernel