The Linux kernel edt-ft5x06 input driver contained a use-after-free vulnerability caused by removal of manual debugfs teardown, relying instead on the I2C core. This created a window where debugfs files could be accessed after the raw_buffer was freed, leading to potential use-after-free conditions. The fix protects the freeing of raw_buffer with a device mutex and sets raw_buffer to NULL, ensuring the debugfs read function safely checks the buffer state under the same mutex. This vulnerability is tracked as CVE-2026-46097 and affects Linux kernel versions prior to 7.0.0-27.27 and related builds. The vulnerability has a CVSS 3.1 score of 7.8 (high impact on confidentiality, integrity, and availability) and is addressed by official patches distributed by Ubuntu. No known exploits are reported in the wild.

Successful exploitation of this use-after-free vulnerability could lead to memory corruption, potentially allowing an attacker with local privileges to compromise system confidentiality, integrity, and availability. The CVSS score of 7.8 reflects high impact across these security properties. However, exploitation requires local access with low privileges and no user interaction is needed. No known active exploits have been reported.

An official patch is available and included in Linux kernel updates distributed by Ubuntu. Users should apply the update to versions 7.0.0-27.27 or later and reboot the system to complete remediation. Due to an ABI change in the kernel update, recompilation and reinstallation of all third-party kernel modules is required. Follow vendor guidance in Ubuntu Security Notice USN-8488-1 for detailed update instructions. No additional mitigation is required beyond applying the official fix.