CVE-2026-80624 Overview
CVE-2026-80624 is a Linux kernel vulnerability in the mfd/cs42l43 multi-function device driver. The driver receives firmware from userspace and dereferences the firmware pointer as a header structure without confirming the received buffer is larger than the header. When a truncated firmware image is supplied, the driver reads beyond the allocated buffer, producing an out-of-bounds memory access in kernel space.
The upstream fix adds a sanity check comparing the firmware size against the header size before any header field is dereferenced.
Critical Impact
A malformed firmware blob smaller than the cs42l43 firmware header triggers a kernel out-of-bounds read, which can leak kernel memory or crash the host running the affected driver.
Affected Products
- Linux kernel builds that include the mfd: cs42l43 driver prior to the fixing commits
- Distributions shipping stable kernels that have not yet backported commits 17d79248, 197a4c54, 2ce02059, b6ef1a74, and d35e4032
- Systems using Cirrus Logic cs42l43 audio/HID codec hardware relying on this MFD driver
Discovery Timeline
- 2026-08-28 - CVE-2026-80624 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-80624
Vulnerability Analysis
The issue lives in the cs42l43 multi-function device driver under drivers/mfd/. The firmware loading path checks that a firmware object was returned by the kernel firmware loader but does not validate its size. The driver then casts the raw firmware buffer to a pointer to the firmware header structure and reads header fields directly.
When the firmware payload is smaller than sizeof(header), any field access on that structure reads memory outside the allocated buffer. This is a classic Out-of-Bounds Read [CWE-125] driven by missing length validation on attacker-influenced input.
Exploitation requires the ability to influence the firmware blob loaded by the driver. In practice this means local privileged access to replace firmware files under /lib/firmware/, a supply-chain compromise of the firmware package, or a physical scenario where the codec device presents a truncated payload. The impact is limited to kernel information disclosure or a denial of service through a kernel oops.
Root Cause
The driver validates presence but not length. It performs an existence check on the firmware object returned from the firmware loader and immediately treats the buffer as a struct containing header fields. There is no check that fw->size >= sizeof(*header) before dereference, so a shorter buffer causes the header read to cross the allocation boundary.
Attack Vector
The attack surface is the firmware loading path for the cs42l43 device. An actor with the ability to place a crafted firmware file in the kernel firmware search path, or otherwise deliver a truncated firmware image to the driver during probe or update, triggers the out-of-bounds read. The vulnerable operation runs in kernel context.
No verified public exploit code exists for CVE-2026-80624. The upstream patch describes the mechanism; see the kernel commits listed in the references for the exact source diff.
Detection Methods for CVE-2026-80624
Indicators of Compromise
- Kernel log entries from the cs42l43 MFD driver referencing firmware load failures, oops traces, or KASAN slab-out-of-bounds reports on the firmware loading path
- Unexpected modifications to files under /lib/firmware/cirrus/ or other cs42l43 firmware directories
- System crashes or hangs correlated with codec driver initialization on hardware using the cs42l43 chipset
Detection Strategies
- Inventory hosts running kernels that include the cs42l43 driver and compare running versions to the fixed stable branches referenced by the upstream commits
- Enable KASAN on test and pre-production kernels to catch the out-of-bounds read deterministically during firmware load
- Monitor file integrity on kernel firmware directories to detect substitution of legitimate firmware with truncated payloads
Monitoring Recommendations
- Forward dmesg and journald kernel messages to a central log store and alert on cs42l43 driver errors, general protection faults, and KASAN reports
- Track package updates for linux-firmware and the kernel to confirm the fixed commits are present on all affected hosts
- Review privileged access to firmware paths and audit root-level file writes under /lib/firmware/
How to Mitigate CVE-2026-80624
Immediate Actions Required
- Update to a Linux kernel version that includes one of the fixing commits: 17d79248, 197a4c54, 2ce02059, b6ef1a74, or d35e4032
- Restrict write access to /lib/firmware/ and its subdirectories to trusted administrative accounts only
- Validate that installed linux-firmware packages come from trusted distribution repositories
Patch Information
The upstream fix adds a size check ensuring the received firmware buffer is at least as large as the firmware header structure before the header is dereferenced. The fix is available in the following stable kernel commits: Kernel Commit 17d79248, Kernel Commit 197a4c54, Kernel Commit 2ce02059, Kernel Commit b6ef1a74, and Kernel Commit d35e4032. Apply the vendor kernel update corresponding to your distribution.
Workarounds
- If patching is not immediately possible and the cs42l43 codec is not required, blacklist the cs42l43 MFD module to prevent the vulnerable code path from loading
- Enforce strict file permissions on kernel firmware directories to prevent unauthorized substitution of firmware blobs
- Deploy signed firmware and verified boot workflows where supported by the platform to reject truncated or tampered firmware images
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.