CVE-2026-46097: Input: edt-ft5x06 - fix use-after-free in debugfs teardown
In the Linux kernel, the following vulnerability has been resolved:
Input: edt-ft5x06 - fix use-after-free in debugfs teardown
The commit 68743c500c6e ("Input: edt-ft5x06 - use per-client debugfs directory") removed the manual debugfs teardown, relying on the I2C core to handle it. However, this creates a window where debugfs files are still accessible after edtft5x06tsteardowndebugfs() frees tsdata->rawbuffer.
To prevent a use-after-free, protect the freeing of rawbuffer with the device mutex and set rawbuffer to NULL. The debugfs read function already checks if rawbuffer is NULL under the same mutex, so this safely avoids the use-after-free.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 68743c500c6e
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46097?
CVE-2026-46097 has a risk score of 34, indicating a moderate severity level.
How do I fix CVE-2026-46097?
To fix CVE-2026-46097, update to the latest Linux kernel version that includes the patch for this vulnerability.
What does CVE-2026-46097 affect?
CVE-2026-46097 affects the Linux kernel, specifically the edt-ft5x06 input driver.
What type of vulnerability is CVE-2026-46097?
CVE-2026-46097 is categorized as a Use After Free vulnerability.
When was CVE-2026-46097 published?
CVE-2026-46097 was published on May 27, 2026.