CVE-2026-64274: Input: goodix - clamp the device-reported contact count
In the Linux kernel, the following vulnerability has been resolved:
Input: goodix - clamp the device-reported contact count
goodixtsreadinputreport() copies the number of touch points reported by the device into an on-stack buffer
u8 pointdata[2 + GOODIXMAXCONTACTSIZE GOODIXMAXCONTACTS];
which is sized for at most GOODIXMAXCONTACTS (10) contacts. The only runtime check bounds the per-interrupt count against ts->maxtouchnum, but that value is taken verbatim from a 4-bit field of the device configuration block and is never clamped:
ts->maxtouchnum = ts->config[MAXCONTACTSLOC] & 0x0f;
The nibble can be 0..15, so a malfunctioning, malicious or counterfeit controller (or an attacker tampering with the I2C bus) can advertise up to 15 contacts. goodixtsreadinputreport() then accepts a touchnum of up to 15 and the second goodixi2cread() writes ts->contactsize (touchnum - 1) bytes past the one-contact header into pointdata - up to 30 bytes (45 with the 9-byte report format) beyond the 92-byte buffer: a stack out-of-bounds write.
Clamp maxtouchnum to GOODIXMAXCONTACTS, the number of contacts pointdata[] is sized for, when reading it from the configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify goodix_ts_read_input_report() to clamp the device-reported contact count: set ts->max_touch_num from ts->config[MAX_CONTACTS_LOC] & 0x0f (nibble 0..15) and enforce a runtime bounds check so the per-interrupt touch count is capped (up to 15), preventing out-of-bounds writes when reading point_data into the on-stack buffer sized for GOODIX_MAX_CONTACTS (10) contacts.
Linux kernel - goodix_ts_input_report (goodix) Clamp device-reported touch count (touch_num / max_touch_num) = Clamp touch_num to GOODIX_MAX_CONTACTS (number of contacts); max_touch_num = ts->config[MAX_CONTACTS_LOC] & 0x0f; runtime bounds check caps per-interrupt count to 15 contacts
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64274?
The severity of CVE-2026-64274 is classified as high with a score of 7.8.
How do I fix CVE-2026-64274?
To fix CVE-2026-64274, it is recommended to update to the patched version of the Linux kernel that resolves this vulnerability.
What systems are affected by CVE-2026-64274?
CVE-2026-64274 affects the Linux kernel specifically in the goodix driver for touch input devices.
What is the impact of CVE-2026-64274 on device security?
CVE-2026-64274 can lead to denial of service or potentially allow unauthorized access through improper handling of touch input data.
When was CVE-2026-64274 published?
CVE-2026-64274 was published on July 25, 2026.