CVE-2026-80768: Linux Kernel HID ft260 Use-After-Free Vulnerability

CVE-2026-80768 Overview

CVE-2026-80768 is a race condition vulnerability in the Linux kernel's HID ft260 driver that leads to a stack-use-after-return write. The ft260_i2c_read() function points dev->read_buf at a caller-supplied buffer, often an on-stack variable, and waits up to five seconds for the device to return data. The HID input callback ft260_raw_event() runs in the IRQ path without holding dev->lock, and copies device-supplied payloads into dev->read_buf after a plain NULL check. If a late device response arrives after the read times out and unwinds the stack, an attacker-influenced write lands in freed stack memory.

Critical Impact
Malicious or malfunctioning USB HID hardware can trigger a bounded stack-use-after-return write in kernel context, enabling potential memory corruption in the Linux kernel.

Affected Products

Linux kernel builds that include the HID ft260 driver (FTDI FT260 USB-to-I2C bridge)
Systems exposing USB HID endpoints to untrusted or externally connected devices
Distribution kernels shipping the vulnerable ft260 driver prior to the referenced stable commits

Discovery Timeline

2026-09-04 - CVE-2026-80768 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80768

Vulnerability Analysis

The flaw resides in the interaction between two independent code paths in drivers/hid/hid-ft260.c. The read path, ft260_i2c_read(), arms a completion and blocks up to five seconds while holding dev->lock. The IRQ-driven ft260_raw_event() handler processes inbound device reports outside that mutex. Both paths share dev->read_buf, dev->read_idx, and dev->read_len with no serialization.

When the device delays its response until timeout, the read path clears read_buf and returns, which unwinds the on-stack buffer supplied by the caller. A response arriving at that moment passes the NULL check in ft260_raw_event(), then memcpy() copies the device-controlled payload into a stack slot that no longer belongs to the original caller.

Root Cause

The root cause is missing synchronization between the process-context read path and the IRQ-context raw event handler. The NULL check on read_buf is not atomic with respect to the subsequent memcpy(), creating a time-of-check to time-of-use window. Because callers pass on-stack buffers, teardown effectively invalidates the target of the pending write.

Attack Vector

Exploitation requires a malicious or malfunctioning FT260 device on the USB bus. The attacker controls response timing and payload contents, allowing a bounded write into freed stack memory. The fix introduces a dedicated spinlock that serializes every access to read_buf, read_idx, and read_len, ensuring ft260_raw_event() holds the lock across the NULL check, memcpy(), and index update.

No public proof-of-concept is available. Technical details are documented in the stable kernel commits, including Kernel Git Commit 2b90700 and Kernel Git Commit d7ffbdc.

Detection Methods for CVE-2026-80768

Indicators of Compromise

Kernel oops or KASAN reports referencing ft260_raw_event or ft260_i2c_read with stack-use-after-return signatures
Unexpected connections of FTDI FT260 USB-to-I2C bridge devices on production or sensitive hosts
Repeated I2C read timeouts logged by the hid-ft260 driver followed by anomalous kernel behavior

Detection Strategies

Enable KASAN or KFENCE in test kernels to catch stack-use-after-return writes originating from HID drivers
Audit loaded kernel modules for hid_ft260 on systems where the driver is not operationally required
Correlate USB device enumeration events with kernel log anomalies to identify suspicious HID hardware

Monitoring Recommendations

Collect kernel ring buffer output (dmesg, journald) centrally and alert on ft260 warnings, timeouts, and crash signatures
Monitor USB attach and detach events via udev or auditd on servers and workstations in restricted environments
Track kernel version inventory to confirm patched builds are deployed across all Linux endpoints

How to Mitigate CVE-2026-80768

Immediate Actions Required

Update to a Linux kernel that includes the stable fix commits referenced in the NVD advisory
Unload the hid_ft260 module on systems that do not require FT260 USB-to-I2C functionality
Restrict physical and logical USB access on sensitive hosts to prevent introduction of malicious HID devices

Patch Information

The fix adds a dedicated spinlock that serializes access to read_buf, read_idx, and read_len. Both the read path and ft260_raw_event() acquire the lock, eliminating the race between buffer teardown and the inbound memcpy(). Patches are available across multiple stable branches. Refer to Kernel Git Commit 460514d, Kernel Git Commit 5aa5a1b, Kernel Git Commit 77832d8, Kernel Git Commit 90e9298, Kernel Git Commit a8e1f97, and Kernel Git Commit bf3e39d for the applicable branch.

Workarounds

Blacklist the hid_ft260 module via /etc/modprobe.d/ where the driver is not needed
Enforce USB device allowlisting using tools such as USBGuard to block unapproved HID hardware
Physically disable or restrict access to USB ports on high-value systems until the patched kernel is deployed

bash

# Configuration example - blacklist the vulnerable module
echo "blacklist hid_ft260" | sudo tee /etc/modprobe.d/blacklist-ft260.conf
sudo rmmod hid_ft260 2>/dev/null || true
sudo update-initramfs -u