CVE-2026-80624

mfd: cs42l43: Sanity check firmware size

State: Published
Severity: Not scored
Published: Aug 28, 2026
Updated: Aug 28, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

mfd: cs42l43: Sanity check firmware size

Currently the code checks if a firmware was received, however it does not verify that the firmware size is larger than the firmware header. As the firmware pointer is dereferenced as a pointer to the header structure this could lead to an out of bounds memory access. Add the missing check.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ace6d14481386ec6c1b63cc2b24c71433a583dc2 to before 2ce02059ceb6311a33026b62e6e4dc4ed22a3aefAffected ace6d14481386ec6c1b63cc2b24c71433a583dc2 to before 197a4c54d8a94fe2fb7829661b29f0859c10feb5Affected ace6d14481386ec6c1b63cc2b24c71433a583dc2 to before d35e4032f16d7621468c8b56816e7935ebf590a7Affected ace6d14481386ec6c1b63cc2b24c71433a583dc2 to before 17d79248b4f370663f9d351409a130fc1ed9416dAffected ace6d14481386ec6c1b63cc2b24c71433a583dc2 to before b6ef1a74b3ec254f87a6a3c554fe8f8083ebd37cAffected
LinuxLinux	6.6Affected before 6.6Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

ace6d14481386ec6c1b63cc2b24c71433a583dc2 to before 2ce02059ceb6311a33026b62e6e4dc4ed22a3aefAffected
ace6d14481386ec6c1b63cc2b24c71433a583dc2 to before 197a4c54d8a94fe2fb7829661b29f0859c10feb5Affected
ace6d14481386ec6c1b63cc2b24c71433a583dc2 to before d35e4032f16d7621468c8b56816e7935ebf590a7Affected
ace6d14481386ec6c1b63cc2b24c71433a583dc2 to before 17d79248b4f370663f9d351409a130fc1ed9416dAffected
ace6d14481386ec6c1b63cc2b24c71433a583dc2 to before b6ef1a74b3ec254f87a6a3c554fe8f8083ebd37cAffected

LinuxLinux

6.6Affected
before 6.6Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.