CVE-2026-80624

A flaw was found in the Linux kernel's mfd: cs42l43 component. This vulnerability occurs because the system does not properly verify that the received firmware's size is larger than its header. An attacker could exploit this by providing a malformed firmware, leading to an out-of-bounds memory access. This could potentially result in system instability or other unpredictable behavior.

A moderate out-of-bounds memory access flaw was found in the Linux kernel's cs42l43 multi-function device (MFD) driver. When loading firmware, the driver checked that a firmware blob had been received but did not verify that its size was at least as large as the firmware header structure that the firmware pointer is dereferenced as. A local attacker able to supply and load a malformed or truncated firmware file on a system with cs42l43 hardware could use this flaw to cause an out-of-bounds memory access, resulting in a kernel panic or other system instability (denial of service). Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt) are affected because they contain the cs42l43 core driver; Red Hat Enterprise Linux 6, 7, and 8, the RHEL 9.2 Extended Update Support stream, and Red Hat In-Vehicle OS streams do not contain the vulnerable code and are therefore not affected. The fix is deferred for the affected RHEL 9 and RHEL 10 streams: because the flaw is rated Moderate, exploitation requires local privileged access and control over the firmware files being loaded, and the primary impact is to availability, the fix will be delivered in a future planned kernel update rather than an immediate update. The residual risk is limited to a local denial of service on systems equipped with cs42l43 hardware.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.