The vulnerability arises in the Linux kernel's cs40l50 haptic driver when handling FF_CUSTOM effects supplied by user space. The driver copies custom data without verifying its length and then reads two 16‑bit words from that buffer. When the supplied length is zero or one, the driver reads beyond the allocated memory, potentially accessing arbitrary kernel memory. If the first word is 0x8000 or higher, the masked value is stored as a negative signed short and used as an index into an array of vibration banks, enabling an out‑of‑bounds array index and further memory corruption. Based on the description, the likely attack vector is a local attacker providing malicious FF_CUSTOM data via the EVIOCSFF ioctl, leading to a kernel crash or denial of service.

All Linux kernel versions containing the cs40l50 haptic driver before the patch. The bug is identified in the generic Linux kernel source and affects any installation that includes this driver.

The CVSS score is 7.8. The EPSS score of <1% indicates a very low predicted exploitation probability, and the vulnerability is not listed in CISA KEV, meaning no known active exploitation reports. The attack would require local kernel access or the ability to inject data into the EVIOCSFF ioctl. If exploited, the impact is a kernel crash or denial of service, but no remote code execution is demonstrated by the current information.