PT-2026-64495 · Linux · Linux
CVE-2026-64274
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
Input: goodix - clamp the device-reported contact count
goodix ts read input report() copies the number of touch points reported
by the device into an on-stack buffer
u8 point data[2 + GOODIX MAX CONTACT SIZE * GOODIX MAX CONTACTS];which is sized for at most GOODIX MAX CONTACTS (10) contacts. The only
runtime check bounds the per-interrupt count against ts->max touch num,
but that value is taken verbatim from a 4-bit field of the device
configuration block and is never clamped:
ts->max touch num = ts->config[MAX CONTACTS LOC] & 0x0f;The nibble can be 0..15, so a malfunctioning, malicious or counterfeit
controller (or an attacker tampering with the I2C bus) can advertise up
to 15 contacts. goodix ts read input report() then accepts a touch num
of up to 15 and the second goodix i2c read() writes
ts->contact size * (touch num - 1) bytes past the one-contact header into
point data - up to 30 bytes (45 with the 9-byte report format) beyond the
92-byte buffer: a stack out-of-bounds write.
Clamp max touch num to GOODIX MAX CONTACTS, the number of contacts
point data[] is sized for, when reading it from the configuration.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux