CVE-2026-80574: Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
In the Linux kernel, the following vulnerability has been resolved:
Input: focaltech - fix array out-of-bounds in focaltechprocessrelpacket
Make finger2 (and also finger1) unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the existing check for FOCMAXFINGERS, as the existing comment says it should, instead of writing to state->fingers[-1].
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In focaltech_process_rel_packet, change finger1 and finger2 variables to unsigned so that when the finger index is 0 (and subtracting 1 would otherwise underflow), it does not overflow and write to state->fingers[-1]; ensure the existing FOC_MAX_FINGERS bounds check is relied upon as described by the comment.
Linux kernel (focaltech) Make finger1 and finger2 unsigned in focaltech_process_rel_packet = unsigned
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel focaltech input driver are exposed when they process relative touch packets containing a finger index of 0. The provided data does not identify affected kernel versions or device models.
What input is required to trigger the out-of-bounds write?
A packet must cause the driver to handle finger1 or finger2 with a finger index of 0. Subtracting 1 then produces an index of -1, which can write to state->fingers[-1].
How does the fix prevent the invalid array access?
The fix makes finger1 and finger2 unsigned. When a packet finger index is 0, subtracting 1 overflows to a value above FOC_MAX_FINGERS, allowing the existing bounds check to reject it.