Executive brief
A Linux kernel input device driver for haptic feedback controllers (cs40l50) fails to validate user-supplied custom data before using it, allowing a local attacker to read out-of-bounds memory or trigger memory corruption. An attacker with access to the force feedback interface could craft malicious input to crash the system or potentially escalate privileges.
Technical details
The cs40l50 haptic vibrator driver's cs40l50_add() function accepts user-space FF_PERIODIC/FF_CUSTOM effect data without validating the custom_len field, which controls the allocation size. The driver subsequently reads two words (custom_data[0] and custom_data[1]) without bounds checking: custom_len=0 results in ZERO_SIZE_PTR dereference, and custom_len=1 causes out-of-bounds read. Additionally, the bank value (custom_data[0]) is masked to 16 bits but stored in a signed integer, allowing negative values to bypass upper-bound checks before array indexing into vib->dsp.banks[]. The fix requires validating that both accessed words are present in the allocation and storing the masked bank value in an unsigned type to ensure the bounds test covers the full range.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-08-26: disclosed