CVE-2026-80575: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80575 Overview

CVE-2026-80575 is a Linux kernel vulnerability in the cs40l50-vibra haptic input driver. The driver's cs40l50_add() function copies custom effect data from user space through the EVIOCSFF ioctl without validating its length. A local attacker can trigger an out-of-bounds read and bypass a bank-index range check by supplying a crafted ff_effect structure. The flaw affects the force-feedback subsystem on systems using the Cirrus Logic CS40L50 haptic controller.

Critical Impact
A local, low-privileged user with access to the input device can read kernel memory out of bounds and index driver bank arrays with attacker-controlled values, enabling information disclosure or memory corruption.

Affected Products

Linux kernel cs40l50-vibra input driver (Cirrus Logic CS40L50 haptic controller)
Linux kernel branches prior to the fixes in commits 3855b6a, 52a818c, 7d5c576, and d385546
Any distribution shipping the vulnerable driver with force-feedback support enabled

Discovery Timeline

2026-08-26 - CVE-2026-80575 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80575

Vulnerability Analysis

The vulnerability resides in the cs40l50_add() function inside the cs40l50-vibra driver. When user space submits a force-feedback effect via EVIOCSFF, the driver copies the effect's custom data buffer directly using memdup_array_user() and stores the caller-supplied custom_len without further checks. The driver then unconditionally reads custom_data[0] (the waveform bank) and custom_data[1] (the index within the bank), assuming both words are present.

Because custom_len is fully user-controlled, an attacker can supply a length that is too short to cover those reads. Two distinct conditions arise from this missing validation, both allowing memory to be read outside the allocated buffer.

Root Cause

The root cause is missing input validation on custom_len combined with an incorrect integer type for the parsed bank value. Specifically:

When custom_len == 0, memdup_array_user() invokes memdup_user() with length zero, which returns ZERO_SIZE_PTR rather than an error. The subsequent read of custom_data[0] dereferences that sentinel pointer.
When custom_len == 1, only two bytes are allocated, but the driver reads custom_data[1], one 16-bit word past the allocation.
The bank value is masked with CS40L50_CUSTOM_DATA_MASK (0xffff) but stored in an s16. A custom_data[0] value of 0x8000 or higher wraps to a negative integer, which passes the bank_type >= CS40L50_WVFRM_BANK_NUM upper-bound check. The driver then indexes vib->dsp.banks[] with this negative value before the switch statement's default case can reject it, producing an out-of-bounds array access.

This pattern combines Out-of-Bounds Read [CWE-125], Improper Input Validation [CWE-20], and Numeric Truncation Error behavior in a single flow.

Attack Vector

Exploitation requires local access to the input event device node (typically /dev/input/eventN) belonging to the CS40L50 haptic device. A user with permission to issue the EVIOCSFF ioctl submits an ff_effect of type FF_PERIODIC or FF_CUSTOM whose custom_len is 0 or 1, or whose custom_data[0] has the high bit set. No user interaction beyond the syscall is required, and the attack is entirely local.

The vulnerability mechanism is described in prose above. See the upstream kernel commits linked under Patch Information for the exact source diff and the reasoning applied by the maintainers.

Detection Methods for CVE-2026-80575

Indicators of Compromise

Unexpected KASAN or slab out-of-bounds read reports referencing cs40l50_effect_bank_set or cs40l50_effect_index_set in kernel logs
Kernel oops or general protection fault traces originating from the cs40l50-vibra module after an EVIOCSFF ioctl
Unprivileged processes opening /dev/input/event* nodes bound to the CS40L50 haptic driver and issuing force-feedback ioctls outside of normal application patterns

Detection Strategies

Enable CONFIG_KASAN on test kernels to catch the out-of-bounds reads in cs40l50_add() during fuzzing or QA.
Audit auditd or eBPF telemetry for ioctl calls with EVIOCSFF against CS40L50 input devices issued by non-standard user-space processes.
Correlate kernel ring-buffer warnings that name the driver with the invoking PID and binary path to identify probing behavior.

Monitoring Recommendations

Ship kernel logs (dmesg, journald) to a central pipeline and alert on driver-name substrings such as cs40l50.
Track access to /dev/input/event* from processes outside the expected desktop or haptic-service allow list.
Monitor loaded kernel module inventory to identify endpoints exposing the vulnerable driver.

How to Mitigate CVE-2026-80575

Immediate Actions Required

Apply the upstream kernel fixes referenced in commits 3855b6a, 52a818c, 7d5c576, and d385546 as soon as vendor packages are available.
Restrict access to /dev/input/event* nodes bound to the CS40L50 to trusted users and services using udev rules and group permissions.
If the driver is not required, unload the cs40l50_vibra module and blacklist it.

Patch Information

The fix requires the two words read by the driver to be present in custom_data and stores the masked bank in a u32 so the existing upper-bound test covers the full range. The da7280 haptic driver already performs this style of custom_len range check and served as the reference. Patches are available in the following upstream commits:

Workarounds

Blacklist the vulnerable module until the kernel is patched: add blacklist cs40l50_vibra to /etc/modprobe.d/.
Tighten udev permissions on CS40L50 input event nodes so only privileged services can issue force-feedback ioctls.
On systems that do not require haptic feedback, rebuild the kernel without CONFIG_INPUT_CS40L50_VIBRA.

bash

# Configuration example
# Prevent the vulnerable driver from loading until patched
echo 'blacklist cs40l50_vibra' | sudo tee /etc/modprobe.d/cve-2026-80575.conf
sudo modprobe -r cs40l50_vibra 2>/dev/null || true

# Restrict access to CS40L50 input event nodes
cat <<'EOF' | sudo tee /etc/udev/rules.d/90-cs40l50.rules
KERNEL=="event*", ATTRS{name}=="*cs40l50*", MODE="0600", GROUP="input"
EOF
sudo udevadm control --reload-rules && sudo udevadm trigger