PT-2026-64495 · Linux · Linux

CVE-2026-64274

·

Published

2026-07-25

·

Updated

2026-07-25

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
Input: goodix - clamp the device-reported contact count
goodix ts read input report() copies the number of touch points reported by the device into an on-stack buffer
u8 point data[2 + GOODIX MAX CONTACT SIZE * GOODIX MAX CONTACTS];
which is sized for at most GOODIX MAX CONTACTS (10) contacts. The only runtime check bounds the per-interrupt count against ts->max touch num, but that value is taken verbatim from a 4-bit field of the device configuration block and is never clamped:
ts->max touch num = ts->config[MAX CONTACTS LOC] & 0x0f;
The nibble can be 0..15, so a malfunctioning, malicious or counterfeit controller (or an attacker tampering with the I2C bus) can advertise up to 15 contacts. goodix ts read input report() then accepts a touch num of up to 15 and the second goodix i2c read() writes ts->contact size * (touch num - 1) bytes past the one-contact header into point data - up to 30 bytes (45 with the 9-byte report format) beyond the 92-byte buffer: a stack out-of-bounds write.
Clamp max touch num to GOODIX MAX CONTACTS, the number of contacts point data[] is sized for, when reading it from the configuration.
Found an issue in the description? Have something to add? Feel free to write us 👾

Related Identifiers

CVE-2026-64274

Affected Products

Linux