CVE-2026-46097

Analyzed Analyzed - Analysis Complete

Use-After-Free in edt-ft5x06 Linux Kernel Driver

Publication date: 2026-05-27

Last updated on: 2026-06-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Input: edt-ft5x06 - fix use-after-free in debugfs teardown The commit 68743c500c6e ("Input: edt-ft5x06 - use per-client debugfs directory") removed the manual debugfs teardown, relying on the I2C core to handle it. However, this creates a window where debugfs files are still accessible after edt_ft5x06_ts_teardown_debugfs() frees tsdata->raw_buffer. To prevent a use-after-free, protect the freeing of raw_buffer with the device mutex and set raw_buffer to NULL. The debugfs read function already checks if raw_buffer is NULL under the same mutex, so this safely avoids the use-after-free.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-25

Generated

2026-07-06

AI Q&A

2026-05-28

EPSS Evaluated

2026-07-05

NVD

CVE-2026-46097

EUVD

EUVD-2026-32480

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 7.0.4 (exc)
linux	linux_kernel	From 6.17 (inc) to 6.18.27 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Mitigation Strategies

The vulnerability has been resolved by updating the Linux kernel to include a fix in the edt-ft5x06 input driver. The fix involves protecting the freeing of raw_buffer with the device mutex and setting raw_buffer to NULL to prevent use-after-free conditions.

Therefore, the immediate step to mitigate this vulnerability is to update your Linux kernel to a version that includes this fix.

Executive Summary

This vulnerability is a use-after-free issue in the Linux kernel related to the edt-ft5x06 input driver. Specifically, after the debugfs teardown function frees a buffer called raw_buffer, there is a window where debugfs files remain accessible, potentially allowing access to freed memory. The problem arose because the manual debugfs teardown was removed, relying instead on the I2C core to handle it, which created this timing window. The fix involves protecting the freeing of raw_buffer with a device mutex and setting raw_buffer to NULL to prevent access after it is freed.

Impact Analysis

This use-after-free vulnerability could lead to undefined behavior such as system crashes or potential exposure of sensitive data if an attacker accesses the freed memory through debugfs. It may allow an attacker with access to debugfs to read or manipulate memory that has already been freed, which could compromise system stability or security.

Hi! I’m here to help you understand CVE-2026-46097. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70