CVE-2026-46097: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46097 Overview

CVE-2026-46097 is a use-after-free vulnerability in the Linux kernel's edt-ft5x06 touchscreen input driver. The flaw exists in the debugfs teardown path for the EDT FT5x06 I2C touchscreen controller. Commit 68743c500c6e ("Input: edt-ft5x06 - use per-client debugfs directory") removed the manual debugfs teardown and delegated cleanup to the I2C core. This change opened a race window in which debugfs files remain accessible after edt_ft5x06_ts_teardown_debugfs() frees tsdata->raw_buffer. A concurrent reader can dereference the freed buffer, leading to memory corruption or a kernel crash.

Critical Impact
Concurrent access to debugfs entries during driver teardown can dereference a freed raw_buffer, resulting in kernel memory corruption or panic.

Affected Products

Linux kernel versions containing commit 68743c500c6e ("Input: edt-ft5x06 - use per-client debugfs directory") prior to the fix
Systems using the edt-ft5x06 I2C touchscreen driver
Stable kernel branches receiving the backported fix commits referenced in the kernel git log

Discovery Timeline

2026-05-27 - CVE-2026-46097 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46097

Vulnerability Analysis

The edt-ft5x06 driver exposes diagnostic interfaces through debugfs, including a raw data buffer accessible by user space. Before commit 68743c500c6e, the driver performed manual debugfs teardown during device removal. The commit refactored teardown to rely on the I2C core to remove debugfs entries automatically. However, the driver continued to free tsdata->raw_buffer inside edt_ft5x06_ts_teardown_debugfs() without synchronizing against in-flight readers.

As a result, a user-space process holding an open debugfs file descriptor can invoke the read handler while the buffer is being freed. The read path dereferences tsdata->raw_buffer after the allocation has been returned to the slab allocator, producing classic use-after-free behavior [CWE-416].

Root Cause

The root cause is missing mutual exclusion between debugfs file operations and the teardown routine that releases raw_buffer. The original design relied on manual debugfs removal to drain readers before deallocation. After delegation to the I2C core, the ordering guarantee no longer held, but the corresponding lock-and-nullify pattern was not introduced. The fix protects raw_buffer deallocation with the device mutex and sets the pointer to NULL. The debugfs read function already checks raw_buffer under the same mutex, which closes the race.

Attack Vector

Exploitation requires local access to the device with permission to open the affected debugfs entries, which are typically restricted to privileged users. An attacker with such access can trigger the unbind or removal path for the touchscreen device while concurrently reading the debugfs raw buffer file. Successful exploitation produces a kernel use-after-free, which can be leveraged for denial of service or, depending on slab layout and timing, kernel memory corruption.

No public proof-of-concept code is referenced in the advisory. Technical details are available in the upstream kernel commits at git.kernel.org commit 9f6c5e7b, git.kernel.org commit a516d438, and git.kernel.org commit f5f9e070.

Detection Methods for CVE-2026-46097

Indicators of Compromise

Kernel oops or panic logs referencing edt_ft5x06_debugfs_raw_data_read or edt-ft5x06 during device unbind operations
KASAN reports flagging use-after-free in the edt-ft5x06 module on slab objects associated with raw_buffer
Unexpected I2C touchscreen device unbind events correlated with debugfs read activity

Detection Strategies

Enable KASAN on test and staging kernels to catch use-after-free conditions in the edt-ft5x06 driver during fuzzing or stress testing
Monitor kernel ring buffer (dmesg) for stack traces referencing edt_ft5x06_ts_teardown_debugfs or touchscreen debugfs paths
Audit installed kernel versions against the fix commits in stable branches to identify systems still exposed

Monitoring Recommendations

Collect and centralize kernel logs from Linux endpoints with touchscreen hardware for review of crash signatures
Track loaded kernel modules and flag systems running edt-ft5x06 on unpatched kernel versions
Alert on repeated debugfs access attempts to /sys/kernel/debug/ paths owned by I2C touchscreen devices

How to Mitigate CVE-2026-46097

Immediate Actions Required

Update the Linux kernel to a version that includes the upstream fix commits 9f6c5e7b, a516d438, or f5f9e070 from the stable tree
Restrict access to debugfs by mounting it with appropriate permissions or disabling it on production systems that do not require kernel diagnostics
Limit which users can trigger device unbind operations through /sys/bus/i2c/drivers/edt_ft5x06/unbind

Patch Information

The upstream fix protects the freeing of tsdata->raw_buffer with the device mutex and sets the pointer to NULL after deallocation. Because the debugfs read handler already validates raw_buffer under the same mutex, the race window is eliminated. The patch is available in the stable kernel tree at kernel.org stable commit 9f6c5e7b, kernel.org stable commit a516d438, and kernel.org stable commit f5f9e070. Distribution vendors are expected to backport these commits into supported kernel releases.

Workarounds

Unload the edt_ft5x06 module on systems that do not require the touchscreen driver until a patched kernel is deployed
Remount debugfs with restricted permissions, for example mount -o remount,mode=700 /sys/kernel/debug, to prevent unprivileged access to the affected interface
Restrict physical and administrative access to systems exposing the affected I2C touchscreen hardware

bash

# Restrict debugfs access as a temporary mitigation
mount -o remount,mode=700 /sys/kernel/debug

# Optionally blacklist the driver if the touchscreen is not in use
echo 'blacklist edt_ft5x06' | sudo tee /etc/modprobe.d/blacklist-edt-ft5x06.conf
sudo update-initramfs -u