CVE-2026-80624 mfd: cs42l43: Sanity check firmware size
A missing size check in the cs42l43 firmware loader allows out-of-bounds memory access, potentially causing crashes or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80624?
CVE-2026-80624 is a memory corruption vulnerability in Linux, published on 28 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mfd: cs42l43: Sanity check firmware size
Currently the code checks if a firmware was received, however it does not verify that the firmware size is larger than the firmware header. As the firmware pointer is dereferenced as a pointer to the header structure this could lead to an out of bounds memory access. Add the missing check.
Which versions are affected by CVE-2026-80624?
How do I fix CVE-2026-80624?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-80624 being exploited?
There is no known exploitation of CVE-2026-80624 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-80624, DEBIAN-CVE-2026-80624, GHSA-f7g6-8fv4-cqjx, UBUNTU-CVE-2026-80624.