CVE-2026-80768 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and organizations using Linux-based systems with the ft260 driver, and security teams responsible for vulnerability management and Linux kernel security. They should assess exposure of Linux kernel installations using the ft260 driver, verify system configurations, and monitor for potential exploitation attempts.

Why it matters

CVE-2026-80768 is a Linux kernel vulnerability in the HID ft260 driver that allows for a stack-use-after-return write. Defenders should assess exposure of Linux kernel installations using the ft260 driver, verify system configurations, and monitor for potential exploitation attempts. Applying the Linux kernel patch is recommended to prevent exploitation.

• Verify Linux kernel configurations and ft260 driver usage
• Assess potential exposure of Linux-based systems
• Monitor system logs for exploitation attempts
• Apply Linux kernel patch to prevent exploitation

Technical summary

The Linux kernel vulnerability CVE-2026-80768 occurs in the HID ft260 driver, specifically in the I2C read race condition. The ft260_i2c_read() function points dev->read_buf at a caller-supplied buffer, arms a completion, and waits for the device to return data. The HID input callback ft260_raw_event() runs independently and copies the device-supplied payload into dev->read_buf after a NULL check. If the device delays its response until the read times out, ft260_i2c_read() resets the controller, clears read_buf, and returns. A response that arrives at that moment lets ft260_raw_event() pass the NULL check and memcpy() the device-controlled payload into the now-freed stack location, triggering a stack-use-after-return write.

Defensive priority

High

Recommended defensive actions

• Review and apply the Linux kernel patch to update the HID ft260 driver
• Assess exposure of Linux kernel installations using the ft260 driver
• Verify system configurations and monitor for potential exploitation attempts
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The Linux kernel vulnerability CVE-2026-80768 was resolved by adding a dedicated spinlock to serialize access to shared variables. The CVE Program and NVD provide official records and assessments. The vulnerability allows for a stack-use-after-return write in the HID ft260 driver, specifically in the I2C read race condition. This occurs when the device delays its response until the read times out, allowing an attacker-influenced payload to be written into a previously freed stack location. Linux kernel developers and maintainers, and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.