CVE-2026-80624: mfd: cs42l43: Sanity check firmware size
In the Linux kernel, the following vulnerability has been resolved:
mfd: cs42l43: Sanity check firmware size
Currently the code checks if a firmware was received, however it does not verify that the firmware size is larger than the firmware header. As the firmware pointer is dereferenced as a pointer to the header structure this could lead to an out of bounds memory access. Add the missing check.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (mfd: cs42l43)to a version that resolves this vulnerability.Fixed in not verify that the firmware size is larger than the firmware header. - Compensating control
If you cannot immediately update, restrict or disable loading/using the affected cs42l43 firmware until the kernel fix (mfd: cs42l43: Sanity check firmware size / missing check) is applied.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems running the Linux kernel with the cs42l43 MFD driver and processing firmware for that device are exposed. The issue occurs when the driver receives firmware that is present but smaller than the expected firmware header.
What would an attacker need to exploit it?
An attacker would need to cause the cs42l43 driver to process an undersized firmware blob. The provided data does not state how such firmware could be supplied or whether this is reachable by an unprivileged local user.
How can I tell whether a system may be affected?
Review whether the kernel includes the cs42l43 MFD driver and whether it loads firmware for CS42L43 hardware. A potentially affected condition is a firmware file or blob whose size is smaller than the driver’s expected header, since the vulnerable code dereferences it as a header without first validating its size.
What is the remediation?
Apply a Linux kernel update containing the firmware-size sanity check referenced in the listed stable commits. The fix verifies that the firmware is larger than the header before dereferencing it, preventing the out-of-bounds memory access.