SB2026082762 - Out-of-bounds read in Linux kernel input misc driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-80575)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to an out-of-bounds read in the cs40l50-vibra driver when processing FF_PERIODIC/FF_CUSTOM effect data supplied through EVIOCSFF. A local user can provide a specially crafted custom data buffer to execute arbitrary code.

The issue can be triggered when the custom data buffer is shorter than the two words later read by the driver, and the bank value handling can also wrap values of 0x8000 or greater to a negative index.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3855b6a11f8a7aceb8181cc08c99afef58517006
• https://git.kernel.org/stable/c/52a818c586ae2c36b7324bfaefb547f5e866a8ae
• https://git.kernel.org/stable/c/7d5c576cb1c86047b1fcb1aa9532e17fc5e46c1d
• https://git.kernel.org/stable/c/d38554602a0b04e85fad28ce72c7500cf50d419b