CVE-2026-80624
Received Received - Intake

Sanity Check Bypass in CS42L43 Linux Kernel Driver

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mfd: cs42l43: Sanity check firmware size Currently the code checks if a firmware was received, however it does not verify that the firmware size is larger than the firmware header. As the firmware pointer is dereferenced as a pointer to the header structure this could lead to an out of bounds memory access. Add the missing check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-80624
EUVD
EUVD-2026-67500

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a missing sanity check for firmware size in the cs42l43 MFD driver. The code verifies if firmware is received but fails to ensure the firmware size exceeds the header size. This could allow an out of bounds memory access when the firmware pointer is dereferenced as a header structure.

Detection Guidance

This vulnerability is specific to the Linux kernel's mfd: cs42l43 driver and involves improper firmware size validation. Detection requires checking if the affected driver is present and examining firmware handling. No direct network detection commands are applicable. Inspect kernel logs for errors related to cs42l43 or firmware loading using dmesg | grep cs42l43 or journalctl -k | grep cs42l43.

Impact Analysis

This vulnerability could lead to memory corruption or crashes if exploited. Attackers might leverage it to execute arbitrary code or cause denial of service by triggering out of bounds memory access in systems using the affected Linux kernel driver.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level memory safety issue in the Linux kernel. Standards like GDPR and HIPAA focus on data protection and privacy, while this issue relates to potential memory corruption due to missing firmware size validation.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this vulnerability. Monitor kernel security advisories and apply updates promptly. If custom firmware is used, ensure it includes proper size validation before loading.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80624. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart