Executive brief
The Linux kernel's HID ft260 driver (used for USB-to-I2C host bridge hardware) contains a race condition in its I2C read path. Malicious or faulty hardware can trigger a delayed response that allows an attacker to write attacker-controlled data to freed kernel stack memory, potentially corrupting kernel state or achieving code execution.
Technical details
The vulnerability is a stack-use-after-return write caused by unserialized access to shared state (read_buf, read_idx, read_len) between the ft260_i2c_read() function and the interrupt handler ft260_raw_event(). When an I2C read times out, the caller's stack buffer is cleared, but a delayed device response can still arrive and cause ft260_raw_event() to perform a memcpy() into the now-freed stack location. The attack requires malicious or malfunctioning FT260 hardware connected via USB. The fix adds a spinlock to serialize all access to the shared read state, preventing the race window between buffer teardown and the interrupt handler's copy operation.
Affected products
- Linux Linux kernel all versions with ft260 HID driver (present since Linux 5.3+)
Timeline
- 2026-09-04: disclosed: Published by NVD
- 2026-08-27: patched: Fix committed to upstream Linux kernel by Raman Varabets