CVE-2026-80575

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Input: cs40l50-vibra - validate custom data from user space

cs40l50_add() copies the custom data of an FF_PERIODIC/FF_CUSTOM effect

straight from the ff_effect the user passed to EVIOCSFF, without

requiring it to hold anything:

work_data.custom_data = memdup_array_user(periodic->custom_data,

periodic->custom_len,

sizeof(s16));

work_data.custom_len = periodic->custom_len;

The driver then reads two words out of that buffer: custom_data[0] as the

waveform bank in cs40l50_effect_bank_set(), and custom_data[1] as the

index within the bank in cs40l50_effect_index_set(). Neither read is

covered by a length check, and custom_len is fully user controlled:

- custom_len == 0 makes memdup_array_user() call memdup_user() with a

length of zero, which returns ZERO_SIZE_PTR rather than an error, so

custom_data[0] derefer

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References