Executive brief
A security vulnerability has been identified in the Linux kernel driver for Goodix touchscreens, which are commonly used in tablets and laptops. A malicious or compromised hardware component could send more touch-point data than the system expects, causing a memory error. This could potentially lead to a system crash or allow an attacker with physical access to the device to compromise the operating system.
Technical details
A stack-based out-of-bounds write exists in the Goodix touchscreen driver (drivers/input/touchscreen/goodix.c) within the goodix_ts_read_input_report() function. The driver reads the 'max_touch_num' value from a 4-bit field in the device configuration block without clamping it to the internal buffer size (GOODIX_MAX_CONTACTS, which is 10). Because the 4-bit field can represent values up to 15, a malicious or malfunctioning controller can trigger a write of up to 45 bytes beyond the allocated 92-byte on-stack buffer. This requires the ability to provide malicious input via the I2C bus. The issue has been resolved by clamping the reported contact count during configuration reading.
Affected products
- Linux Linux Kernel a7ac7c95d468 to e825f352ef52
Timeline
- 2026-06-12: disclosed: Vulnerability reported by Bryam Vargas
- 2026-07-18: patched: Fix committed to stable kernel trees
- 2026-07-25: advisory: CVE-2026-64274 published
References
- https://git.kernel.org/stable/c/2a67668690129953e898923260a2dd1c7c196495
- https://git.kernel.org/stable/c/3b32303460155603d25444274856013d211d5e1f
- https://git.kernel.org/stable/c/46addbd13dbf4aacb71cfbca964a5e552d0f45ae
- https://git.kernel.org/stable/c/4bfea9c3a0981c1c7fc5d1a1b27197b2de247902
- https://git.kernel.org/stable/c/5ed62a96e06be4e94b8296b7932afee550a70e04
- https://git.kernel.org/stable/c/719d1a2c83a46be6bf81af905e4f6adb3d32dc28
- https://git.kernel.org/stable/c/98b2caef249183b572c04451365246f919707845