A race condition in the Linux kernel HID ft260 driver allows an attacker to trigger a stack‑use‑after‑return write during an I2C read operation. The vulnerability arises when the read path releases a buffer before the input/IRQ callback copies device data into it, enabling the callback to write payload data into a freed stack location. This bounded but attacker‑controlled write can corrupt kernel memory, potentially allowing privilege escalation or system compromise. This scenario exemplifies a use‑after‑return flaw, which is classified as CWE‑416.

This issue affects the Linux kernel wherever the HID ft260 driver is compiled. No specific kernel versions are listed, so all releases prior to the fix are potentially impacted.

The vulnerability is not listed in CISA’s KEV catalog and has no EPSS score available, indicating limited publicly known exploitation. However, the use‑after‑return write is a serious memory‑corruption flaw identified as CWE‑416. Based on the description, the likely attack vector is malicious or malfunctioning hardware sending crafted I2C data after a read timeout, which can trigger the race and lead to kernel memory corruption with the potential for arbitrary code execution or system instability.